bear/security

Lifecycle scriptscaution

The package defines both post-install-cmd and post-update-cmd scripts, so dependency installation and updates execute package-controlled code. This is an operational supply-chain risk even though it is not evidence of malicious behavior.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, despite the package's recent release history. This is a meaningful maintenance and abandonment concern.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and disclosure expectations unclear for a security-focused package.

Workflow auditcaution

The single analyzed workflow had 0 dangerous sinks and no audit findings, but both of its 2 action references are unpinned. The missing top-level permissions block is acceptable on its own, so the remaining concern is reproducibility and action drift.