@amplitude/experiment-core

Lifecycle scriptscaution

The package has a prepublish lifecycle script; this warrants awareness because installation-related scripts can affect reproducibility, although prepublish is not by itself a severe concern.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating a transparency concern that the link may not specifically document this package; organization backing and the package scope provide some context but do not remove the gap.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and security-process transparency unclear.

Token permissionscaution

All 7 workflows lack top-level token permissions declarations, which weakens least-privilege clarity even though none declares top-level write permissions.

Version stabilitycaution

Version 0.13.6 is not a stable major release, but it is a normal release rather than a prerelease and only 5% of recent releases were prereleases.