lefthook-linux-x64

Repo package mentioncaution

The repository name does not match the platform-specific package name and its README does not contain that exact package name, creating some linkage ambiguity. The README nevertheless clearly documents Lefthook and the package artifact is a platform binary for that project.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts or script injection, but every one of 42 action references is unpinned, the release workflow uses floating latest container images and top-level write permissions, and high-confidence adhoc-package findings install outside a lockfile. The cache-poisoning findings are low confidence, so they add limited weight.