bun

Build provenancecaution

No build attestation or trusted publisher identity is recorded for this release, leaving the registry artifact’s build origin less transparent despite the linked project being active.

Lifecycle scriptscaution

The package runs a postinstall script, which adds installation-time behavior and supply-chain exposure for a package that installs platform-specific binaries.

Workflow auditcaution

The audit analyzed 30 of 31 workflows with no failed files, all 64 action references pinned, and read-only permissions in 29 workflows. One high-severity cache-poisoning pattern had low confidence, while trusted-publishing findings indicate registry credentials are used instead of short-lived credentials, so workflow hygiene is not flawless.