@ai-sdk/react

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. This can be normal for a monorepo, but the absence of either direct match or README mention leaves package-to-repository alignment less transparent.

Workflow auditcaution

All 13 workflows were analyzed and all action references are pinned, but one workflow combines an untrusted checkout with a workflow_run trigger, and two workflows use broad top-level write permissions. High-confidence GitHub-app and template-injection findings add workflow hygiene concerns, while the cache findings are low-confidence and do not independently outweigh the project's strong maintenance evidence.