@atlaskit/pragmatic-drag-and-drop

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, but not severe enough to outweigh the active release history.

Repo bus factorcaution

All three recent commits came from one contributor, creating a concentrated short-term bus factor. Organization ownership provides some ability to hand maintenance off, so this is a caution rather than a severe risk.

Repo commit activitycaution

Only three commits were recorded in the last three months, indicating a slow recent development pace. The recent push and regular package releases partly compensate, but the activity still lowers confidence in ongoing maintenance capacity.

Repo issue activitycaution

The repository has 95 open issues and no new or closed issues or pull requests in the last month. This suggests limited recent issue-handling activity, though it is not by itself evidence of abandonment.

Repo toolingcaution

TypeScript build tooling is present, but no security-scanning tools were detected. The missing scanning is a repository hygiene gap, not evidence that the release is unsafe on its own.