rc-notification

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the published artifact's origin less independently verifiable.

Lifecycle scriptscaution

A prepare install-time script is present, adding a small amount of installation complexity even though no more dangerous lifecycle script is reported.

Release historycaution

The package is mature, with 80 releases since 2015, but it has had no registry release in the last 12 months. Recent repository activity partly compensates for the paused publishing cadence.

Security policycaution

The repository has no published security policy, reducing transparency for reporting and handling vulnerabilities.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts, but 3 workflows grant top-level write permissions and 5 of 10 action references are unpinned. These are workflow hygiene concerns, not a severe risk on their own.