@chakra-ui/react-utils

Build provenancecaution

No build attestation or trusted publisher identity is present, leaving the connection between source and published artifact less transparent. The repository does use established build tooling, which partly offsets this gap.

Release historycaution

The package has 111 releases since March 2021, but none in the last three years and eight months, with the latest release on January 12, 2023. Active repository work compensates for some abandonment concern, but the published package is clearly stale.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating uncertainty about package-to-source alignment. The shared organization and namespace reduce, but do not eliminate, that concern.

Repo toolingcaution

The project uses TypeScript, Vite, npm scripts, esbuild, Rollup, and tsup for builds. It reports no security scanning tools, which is a modest process gap rather than evidence of abandonment.

Token permissionscaution

Two workflows lack top-level permissions and one declares top-level write access, so workflow token scope is not uniformly explicit or restrictive.