@remotion/renderer

Render Remotion videos using Node.js or Bun

Latest 4.0.535

78%

Total Score

healthy

A highly active, stable release from a well-backed project is offset by workflow injection risk and weak repository-to-package linkage.

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher identity was detected. This reduces release transparency, although the package has a long, highly active release history.

Repo package mention

The repository name does not match @remotion/renderer and its README does not mention the package. This may reflect a normal monorepo layout, but it weakens direct package-to-repository transparency.

Repo tooling

The repository uses TypeScript, Turbo, npm scripts, and Vite, showing an established build system. No security-scanning tools were detected, leaving a modest transparency gap.

Security policy

No repository security policy was detected. This is a documentation and disclosure gap, though the active organization and extensive maintenance evidence partly compensate.

Workflow audit

All six workflows were analyzed, but all 61 detected action uses are unpinned and a high-confidence template-injection finding appears in changelog.yml. The low-confidence cache-poisoning finding is hygiene-level, and no untrusted checkout or script-injection sink was found.