@rc-component/tree-select

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the artifact-to-source build path less independently verifiable.

Lifecycle scriptscaution

A prepare script runs during installation or packaging. This is a mild supply-chain consideration, but the provided signals do not show that it performs unsafe behavior.

Repo bus factorcaution

One contributor made 9 of 11 recent commits, creating concentration risk, although two additional contributors remained active.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response procedures unclear.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts, and some jobs scope permissions. However, three workflows have top-level write permissions and five of ten action references are unpinned, leaving moderate workflow hygiene gaps.