@oxc-parser/binding-linux-x64-gnu

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, which weakens package-to-source traceability. The organization-backed monorepo context makes a subpackage relationship plausible, but the missing explicit mention remains a transparency gap.

Workflow auditcaution

The audit found eight high-confidence github-app findings where app tokens inherit blanket installation permissions, creating a meaningful workflow-permission concern. Other controls are strong: all 209 action references are pinned, most workflows use read-only permissions, and no untrusted checkout or script-injection paths were found.