Only the latest release receives security updates.

If you discover a security vulnerability, please report it privately via GitHub Security Advisories.

Do not open a public issue for security vulnerabilities.

You can expect an initial response within 48 hours. We will work with you to understand the issue and coordinate a fix before any public disclosure.

Supply-chain scanners flag the ferrflow npm package for containing a remote URL. This section records the review so it does not have to be repeated per release.

The package publishes bin/ only (files: ["bin"]), which is a single file: bin/ferrflow.js. It contains exactly one URL:

"Install ferrflow from https://github.com/FerrLabs/FerrFlow/releases"

That string is display text inside a console.error on the unsupported-platform path. It is never fetched.

The package cannot make a network request. Its entire import graph is child_process, fs, path, url, module and os. There is no HTTP client, no fetch, and no net. Its only job is to resolve the platform binary from the matching @ferrflow/* optional dependency and spawnSync it.

There are no preinstall, postinstall or prepare scripts in the wrapper or in any platform package. The platform packages carry no JavaScript at all: the binary is placed into them by the release workflow, and they declare no bin and no scripts.

Releases ship a SHA256SUMS, cosign signatures and build-provenance attestations. See Verifying releases for how to check them yourself; the GitHub Action verifies the digest before extracting.