@popperjs/core

Lifecycle scriptscaution

The package uses a prepare install-time script, which adds some installation complexity and warrants review, but this signal alone does not indicate that the release is unfit to use.

Release historycaution

The package has a substantial history of 75 releases since 2019, but version 2.11.8 was last published over three years ago and there were no releases in the last 12 months. Active repository work partly compensates for the old registry release.

Repo toolingcaution

The repository uses established build tools including TypeScript, Rollup, Vite, Babel, and npm scripts. No security-scanning tools were detected, leaving a security-process gap.

Token permissionscaution

Three workflows lack top-level token permissions and one workflow grants top-level write access, so CI privilege boundaries are less explicit than ideal.