@reown/appkit

Lifecycle scriptscaution

A postinstall script runs during installation, adding supply-chain and reproducibility exposure that should be reviewed before adoption.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Token permissionscaution

Seven workflows lack top-level permissions and four declare write permissions, creating avoidable CI permission ambiguity despite no detected untrusted checkout or script injection.

Version stabilitycaution

Version 1.8.24 is a stable major and not a prerelease, although 95% of recent releases being prereleases indicates a highly experimental release stream around it.