rc-tree-select

Lifecycle scriptscaution

A prepare script runs during installation, adding execution during package setup. No provided evidence shows that it is unsafe, so this is a limited supply-chain hygiene concern rather than a severe risk.

Release historycaution

The package has a long history and 270 releases, but there has been no registry release for about 20 months. Active repository commits partly compensate for the stale registry cadence.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention rc-tree-select, so the linkage is less transparent than expected. The name mismatch could be normal for a related component repository, but the absence of a README mention remains a caution.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less transparent. Existing security scanning partly offsets this documentation gap.

Workflow auditcaution

All five workflows were analyzed with no detected high-confidence findings or untrusted checkouts, but three workflows grant top-level write permissions and half of action references are unpinned. These are workflow hygiene concerns without an observed untrusted sink.