onnxruntime-common

Build provenancecaution

No build attestation or trusted publisher identity is present, leaving the connection between source and published artifact less transparent than it could be.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation, which adds installation complexity and warrants review, although no other evidence here indicates harmful behavior.

Repo package mentioncaution

The repository name does not match the package and its README does not mention onnxruntime-common, so the exact source-to-package relationship is less transparent and merits verification; the name mismatch alone is not decisive for a monorepo sub-package.

Token permissionscaution

Thirteen analyzed workflows lack top-level permissions and 16 declare top-level write access, which is broader workflow permission hygiene than ideal, though one workflow explicitly uses read-only permissions and no dangerous workflow pattern was detected.