@dnd-kit/sortable

Lifecycle scriptscaution

A prepublish lifecycle script is present. This is a limited supply-chain and reproducibility consideration, but the signal does not show a dangerous install-time script.

Project backingcaution

The package is backed by a linked repository owned by the publishing user rather than an organization. This does not undermine the project because repository activity shows six recent contributors, but it leaves less formal ownership redundancy.

Release historycaution

The package has 112 releases since January 2021, but none in the last 12 months and the latest release was about 21 months ago. This is a meaningful currency concern, although the active repository provides compensating evidence that development has not stopped.

Repo toolingcaution

The repository uses build tooling, but no security-scanning tools were detected. The missing scanning is a transparency gap, though it is not by itself evidence of unsafe maintenance.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less clear for consumers and maintainers.