@rc-component/mutate-observer

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less verifiable, though this is a transparency gap rather than evidence of unsafe behavior.

Lifecycle scriptscaution

A prepare install-time script is present, which adds some installation complexity, but this signal alone does not indicate a maintenance or abandonment problem.

Release historycaution

The package has five releases over about 3 years and 8 months, with one release in the last 12 months; the roughly 8.5-month median interval indicates modest rather than rapid maintenance.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

All five workflows were analyzed with no reported audit findings or untrusted checkouts, but five of ten action references are unpinned and three workflows grant top-level write access, creating moderate workflow hygiene risk.