onnxruntime-node

Build provenancecaution

No registry build attestation or trusted publisher provenance is present. The active, organization-backed repository reduces concern about project continuity but does not replace release provenance.

Lifecycle scriptscaution

The package uses postinstall, prepack, prepare, and preprepare scripts. Install-time scripts are expected for a native binding that selects or prepares platform binaries, but they still increase installation complexity and supply-chain exposure.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention onnxruntime-node. This is plausible for a monorepo, but the missing explicit package reference leaves some uncertainty that this repository directly tracks the published package.

Token permissionscaution

Thirteen workflows lack top-level permissions and 16 declare top-level write access. Organization backing and security tooling compensate for some concern, but broad or implicit permissions remain a repository hygiene gap.