@dnd-kit/utilities

Build provenancecaution

No build attestation or trusted-publisher provenance is available, which limits publication transparency, but this is not evidence that the package is unsafe by itself.

Lifecycle scriptscaution

A prepublish lifecycle script adds some install and publication complexity, but this signal alone does not show a dangerous install-time workflow.

Release historycaution

The latest registry release was nearly three years ago, with no releases in the last 12 months. This is a maintenance caveat, although the linked repository shows current activity.

Repo toolingcaution

The repository uses build tooling, but no security-scanning tools were detected, leaving a modest transparency and assurance gap.

Security policycaution

The repository has no SECURITY.md policy, reducing clarity about vulnerability reporting and response procedures.