@amplitude/rrweb-packer

Lifecycle scriptscaution

A prepublish lifecycle script adds release-time behavior that deserves attention, although the exact-version release notes and provenance provide compensating transparency.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-source alignment; the organization-owned rrweb monorepo context partly explains the name mismatch.

Security policycaution

The repository has no SECURITY policy, leaving vulnerability-reporting expectations and response contacts less transparent.

Workflow auditcaution

All six workflows were analyzed, all 22 action references are pinned, and permissions are job-scoped in five workflows. A high-confidence low-severity adhoc-packages finding in the release workflow is a limited hygiene concern, not a severe risk by itself.