@prisma/engines

Lifecycle scriptscaution

A postinstall script downloads platform-specific Prisma engines from a CDN. This is documented and expected for this internal engine package, but it adds install-time supply-chain and availability exposure.

Repo package mentioncaution

The linked Prisma monorepo does not match the package name and does not mention @prisma/engines in its README. This is plausible for a monorepo subpackage, but the missing explicit mention leaves package ownership less transparent.

Workflow auditcaution

All 17 workflows were analyzed with no untrusted checkout or script-injection findings. High-confidence secrets-inherit and informational use-trusted-publishing findings remain workflow hygiene concerns, while the cache-poisoning findings are low-confidence and do not independently establish a severe risk.