@mixpanel/rrweb-snapshot

Build provenancecaution

No registry build attestation or trusted publisher identity is provided, leaving the artifact's build origin less independently verifiable.

Dangerous workflowscaution

One workflow uses pull_request_target with an untrusted checkout, creating a meaningful CI risk even though no script injection was detected.

Lifecycle scriptscaution

The package declares prepack, prepare, and prepublish lifecycle scripts, which add build-time execution during installation or publication and warrant review.

Repo popularitycaution

The repository has only three stars and three forks, which is limited adoption evidence but does not outweigh its active organization-backed maintenance.

Repo toolingcaution

The repository uses established build and test tools, but no security-scanning tools were detected, leaving a security-hygiene gap.