An idea could be to have a dedicated security-message: field working like post-message:. On opam update you collate these messages for the installed packages and spit them out at the end of the update. And on install you spit them out at the end of the install if you installed a vulnerable package (or if there is any vulnerable package in the install).
5 Likes