rrweb

Lifecycle scriptscaution

The package declares prepack, prepare, and prepublish lifecycle scripts. These can perform build or publication work during package operations, so they add some installation transparency and execution risk.

Package scaffoldingcaution

The package has a substantial README and this exact version has GitHub release notes; repository tests and a changelog further support mature project practices. The README explicitly says this package is retained for backward compatibility and recommends newer entrypoints for new projects.

Registry deprecationcaution

The registry does not mark this release or package as deprecated, so there is no registry withdrawal concern. However, the package README says it is deprecated for backward compatibility and directs new projects to @rrweb/record and @rrweb/replay.

Repo toolingcaution

The repository uses established TypeScript, Vite, Vitest, Turbo, and bundling tools. No security scanning tools were detected, leaving a modest security-process gap.

Workflow auditcaution

All seven workflows were analyzed and job-level permissions are used, with no untrusted checkout or script-injection findings. However, one high-confidence medium finding exposes the entire secrets context, and 18 of 25 action references are unpinned; the informational trusted-publishing finding also warrants workflow review.