@posthog/cli

Workflow auditdanger

The audit analyzed only 30 of 142 workflows and found 41 high-confidence high-severity github-app findings, including blanket installation permissions and disabled token revocation. Although no untrusted checkout or script injection was found and action references are pinned, the incomplete coverage and broad app permissions are significant supply-chain hygiene concerns.

Lifecycle scriptscaution

The package uses a postinstall script, which is expected for a CLI that installs or prepares a native executable, but it increases install-time trust and review requirements.

Maintainerscaution

The package has 21 registry publishers, with 11 using the posthog.com domain, consistent with organization ownership. Several consumer-domain accounts and rauln (raulnegron.me) remain account-hygiene cautions, but the company-backed publisher group compensates for them.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @posthog/cli. A monorepo can legitimately contain subpackages, but the missing README reference leaves package-to-source ownership less transparent.