framer-motion

Build provenancecaution

No build attestation or trusted-publisher identity is present. The active repository and strong release history reduce concern, but publication provenance remains less verifiable.

Lifecycle scriptscaution

A prepack script runs during packaging. This is a mild supply-chain and reproducibility consideration, but a single packaging-time script is not by itself a serious health problem.

Repo toolingcaution

The project uses established build tools including TypeScript, esbuild, Rollup, Webpack, Turbo, and npm scripts. No security scanning tools were detected, leaving a modest process gap.

Security policycaution

The repository has no published security policy. This reduces disclosure transparency, although the strong maintenance activity and workflow audit provide partial context.

Workflow auditcaution

All one workflow was analyzed with no findings, no untrusted checkouts, no script injection, and job-level permissions. However, both of its two action references are unpinned, which weakens build reproducibility and supply-chain hygiene.