@rc-component/select

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving the artifact-to-source build path less independently verifiable.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation or packaging, adding a small execution-surface concern even though this is a common build workflow.

Security policycaution

The repository has no published security policy, which makes vulnerability-reporting expectations less clear, though automated security scanning partly compensates.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts; however, 5 of 10 action references are unpinned and 3 workflows grant top-level write permissions, creating modest reproducibility and token-scope concerns.