rc-tabs

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent than it could be.

Lifecycle scriptscaution

A prepare script runs during package installation, which adds execution surface, although no other lifecycle concern is shown.

Release historycaution

The package has 240 releases over nearly 12 years, but no registry releases in the last 12 months. Recent repository activity partly compensates for the quiet release cadence.

Security policycaution

The repository has no published security policy, which leaves vulnerability-reporting expectations unclear.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkout and script-injection paths. However, three workflows grant top-level write permissions and half of the ten action references are unpinned, creating a modest reproducibility and least-privilege gap.