@rc-component/virtual-list

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving the connection between source and published artifact less independently verifiable.

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script, which adds some installation complexity and should be reviewed, though this signal alone is not evidence that the release is unsafe.

Security policycaution

The repository has no published security policy, reducing clarity about how vulnerabilities should be reported and handled.

Token permissionscaution

One workflow lacks top-level permissions and two declare top-level write access, which is less restrictive than ideal, although no dangerous workflow patterns were detected.