@remotion/streaming

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @remotion/streaming, so package ownership is less transparent. The monorepo context makes a name mismatch ordinary, but the absent README mention remains a caution.

Repo toolingcaution

The repository uses TypeScript, Turbo, npm scripts, and Vite for builds. No security-scanning tooling was detected, which modestly limits assurance but does not outweigh the observed maintenance activity.

Security policycaution

The linked repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All six workflows were analyzed, with no untrusted checkout or script-injection counts, but the audit found a high-confidence template-injection issue and 61 unpinned action uses against 50 analyzed references. The low-confidence cache-poisoning finding is hygiene-level only.