@figspec/react

Build provenancecaution

No build attestation or trusted publisher provenance is available, reducing publication transparency, though this is not by itself evidence that the package is unsafe.

Maintainerscaution

Only one registry publishing account is listed, leaving a thin publishing base; the repository is user-owned, so no organization backing compensates for that limitation.

Project backingcaution

The source repository is owned by an individual rather than an organization, offering no demonstrated organizational backing to offset the thin maintainer and activity signals.

Release historycaution

The package has existed for about 5 years and has 13 releases, but it has had no releases in the last 18 months, which is a maintenance concern for an actively consumed library.

Repo commit activitycaution

There have been zero commits and zero active maintainers in the last 3 months, consistent with the long release pause and raising abandonment risk.