@remotion/bundler

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This leaves artifact origin less independently verifiable despite the active organization-backed project.

Repo package mentioncaution

The repository name does not match this package and its README does not mention @remotion/bundler. The organization and monorepo context make a name mismatch ordinary, but the absent README mention leaves package ownership somewhat less explicit.

Repo toolingcaution

The repository uses TypeScript, Turbo, npm scripts, and Vite, but no security scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of unsafe code.

Security policycaution

No repository security policy was found. This reduces disclosure transparency, although the strong maintenance activity partly offsets the concern.

Workflow auditcaution

All six workflows were analyzed successfully, and the pull_request_target workflow has no untrusted checkout or script-injection count. However, a high-confidence template-injection finding in changelog.yml is a real workflow hygiene risk; the low-confidence cache-poisoning finding is minor.