@ai-sdk/react

Repo package mentioncaution

The repository name does not match @ai-sdk/react and its README does not mention the package, creating a package-identity transparency concern; the monorepo context makes a name mismatch alone ordinary, but the absence of a README mention remains cautionary.

Workflow auditcaution

All 13 workflows were analyzed and all action references are pinned, but one workflow combines workflow_run with an untrusted checkout, and two high-confidence github-app findings report blanket app-token permissions. The many low-confidence cache findings are hygiene concerns rather than standalone severe evidence.