@cometchat/chat-uikit-react

Build provenancecaution

No build attestation or trusted publisher identity is present, so consumers have limited cryptographic evidence linking the published artifact to its source build.

Lifecycle scriptscaution

A prepare script runs during package installation or preparation, adding an install-time execution surface that deserves review even though this signal alone is not severe.

Maintainerscaution

Eleven of 13 registry publishers use the cometchat.com domain, consistent with organization-backed publishing. The two outside-domain accounts, anantgarg and ranjanravi85 at inscripts.com, are an account-hygiene caution but do not establish a maintenance bus-factor problem.

Repo toolingcaution

The project uses TypeScript, Vite, tsup, webpack, Vitest, and npm scripts, showing a structured build setup, but no security-scanning tools were detected.