rc-select

Build provenancecaution

No registry build attestation or trusted-publisher provenance is present, reducing publication transparency, but this is not by itself evidence that the release is unsafe.

Lifecycle scriptscaution

A prepare script runs during installation or package setup, adding some execution-time complexity, but this signal alone does not show dangerous behavior.

Release historycaution

The package is mature with 476 releases over more than 11 years, but it has had no registry release in the last 12 months. Recent repository activity partly offsets the stale published cadence.

Repo package mentioncaution

The repository name differs from rc-select and its README does not mention the package, which creates a package-to-source identity concern. The repository path clearly corresponds to the select component, so this is a limited caution rather than a severe finding.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting guidance less transparent for consumers.