@mixpanel/rrweb

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving the connection between source and published artifact less transparent despite the active repository.

Repo toolingcaution

The project uses established build and test tools, though no security-scanning tools were detected, leaving a modest security-process gap.

Version stabilitycaution

The assessed release is a prerelease, and all recent releases are prereleases, so consumers should expect more API or behavior change than with a stable line.

Workflow auditcaution

All three workflows were analyzed, all 18 action references are pinned, and no audit findings were reported. However, style-check.yml combines pull_request_target with an untrusted checkout, creating a workflow hygiene concern.