paulo-hortelan/onmt

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a supply-chain consideration because dependency installation executes package code, though the signal does not establish that the script is unsafe.

Project backingcaution

The repository owner is an individual user rather than an organization, so there is no organizational handoff capacity to compensate for concentrated maintenance.

Repo bus factorcaution

One contributor made all 11 commits in the last 3 months, giving the project a very low bus factor. The active release cadence helps, but does not remove the risk if that maintainer becomes unavailable.

Security policycaution

The repository has no security policy. For a package that manages network equipment connections, this reduces the clarity of vulnerability-reporting and response expectations.

Workflow auditcaution

All three workflows were analyzed, but all six action references are unpinned. A high-confidence bot-conditions finding affects a pull_request_target workflow, while two workflows grant top-level write permissions; together these are meaningful workflow-hygiene concerns without proving the release is unsafe.