@mixpanel/rrweb-utils

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the origin of the published artifact less verifiable.

Lifecycle scriptscaution

The package has a prepublish lifecycle script, which adds a small amount of release-process complexity compared with a package without lifecycle hooks.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so package ownership is less directly transparent; the monorepo context partly explains the name mismatch but not the absent mention.

Version stabilitycaution

The assessed version is a prerelease, and all recent releases are prereleases, so consumers should expect API or behavior changes despite the stable major number.

Workflow auditcaution

All 18 analyzed action references are pinned and the audit found no reported findings, but one pull_request_target workflow checks out untrusted code, creating a concrete workflow hygiene risk.