lefthook

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the artifact-to-source build path less independently verifiable.

Lifecycle scriptscaution

A postinstall script runs during installation, which is expected for fetching or selecting a platform binary but increases install-time execution risk.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkout or script-injection findings, but all 42 action references are unpinned and the release workflow uses floating latest container images with broad top-level write permission; the high-confidence pinning issues warrant caution, while low-confidence cache findings are not decisive.