rc-menu

Lifecycle scriptscaution

A prepare install-time script is present, which adds some installation complexity, but the signal provides no evidence that it performs risky behavior.

Release historycaution

This is a mature package with 284 releases since January 2015, but it has had no registry release in the last 12 months. Active repository commits partly compensate for the publishing pause.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less explicit; this is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts. However, three workflows grant top-level write permissions and five of ten action references are unpinned, creating mild workflow hygiene concerns without an observed dangerous trigger or sink.