@xstate/fsm

Lifecycle scriptscaution

The package runs a prepare script during installation. This is not inherently unsafe, but it adds install-time behavior that deserves more scrutiny than a package with no lifecycle scripts.

Release historycaution

This package has 28 releases but none in the last 12 months, and version 2.1.0 was published over three years ago. Active repository work partly offsets the risk, but the registry release cadence remains a maintenance concern.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @xstate/fsm. This may be normal for a monorepo sub-package, but the missing explicit reference reduces package-to-source transparency.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations less transparent. Security scanning tooling provides partial compensation but does not replace a policy.