@rc-component/cascader

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving publication provenance less verifiable despite the otherwise active project.

Lifecycle scriptscaution

The package runs a prepare script during installation, which adds build or installation behavior that consumers should account for, but no more dangerous lifecycle scripts are reported.

Security policycaution

The repository has no SECURITY.md or equivalent security policy, which reduces transparency for vulnerability reporting.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts, but 5 of 10 action references are unpinned and 3 workflows grant top-level write permissions; this is a moderate workflow-hygiene concern, not a severe risk because no untrusted trigger or sink was found.