framebus

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence was observed, leaving release provenance less verifiable than ideal; this is a transparency gap rather than evidence of abandonment.

Lifecycle scriptscaution

The package has a prepare install-time lifecycle script, which warrants review because it executes package-defined work during installation; the signal alone does not establish that it is unsafe.

Token permissionscaution

Six of nine workflows lack top-level permissions declarations and one workflow declares top-level write permissions, reducing least-privilege transparency; two workflows have read-only permissions, which partially mitigates the concern.