rc-motion

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers have less evidence connecting the artifact to its source. This is a transparency gap rather than evidence of unsafe behavior.

Lifecycle scriptscaution

The package declares a prepare install-time lifecycle script, which adds installation behavior that should be understood by consumers. No provided signal shows that the script is dangerous, so this is a limited hygiene concern.

Release historycaution

The package has 45 releases since August 2020, but none in the last 12 months and the latest registry release was about 21 months ago. Recent repository activity partly offsets the release gap, but the long publishing pause remains a maintenance concern.

Repo package mentioncaution

The repository name does not match rc-motion and its README does not mention the package, so the package-to-repository relationship is less transparent than expected. The organization-owned repository provides context but does not resolve that mismatch.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations unclear. Its CodeQL, Dependabot, and Socket tooling partly compensates for this documentation gap.