@rc-component/dropdown

Lifecycle scriptscaution

The package runs a prepare install-time script. This is a modest supply-chain and installation-complexity concern, though it is not by itself evidence that the release is unsafe.

Security policycaution

The repository has no published security policy. This is a transparency gap for vulnerability reporting, but it is a secondary concern given the active repository and security scanning tools.

Token permissionscaution

Three workflows request top-level write permissions and one CodeQL workflow lacks top-level permissions. Although no dangerous workflow pattern was detected, these declarations leave avoidable permission-hardening gaps.