@liveblocks/react-ui

Build provenancecaution

No build attestation or trusted-publisher identity is provided, leaving publication provenance less verifiable, but this is a transparency gap rather than evidence of abandonment.

Maintainerscaution

Two of three publishing accounts use the organization domain, and the repository is organization-owned; the outside-domain account nvie (nvie.com) is an account-hygiene caution, not evidence of limited maintenance capacity.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less clear for adopters.

Workflow auditcaution

All 13 workflows were analyzed with no untrusted checkout or script-injection findings; five high-confidence template-injection findings remain in Docker and publishing workflows, so workflow hygiene needs attention even though no dangerous trigger was reported.