@phosphor-icons/react

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is recorded, leaving release provenance less transparent than it could be. This is a transparency gap, not evidence that the package is unsafe.

Maintainerscaution

Only one registry account has publish access, which is a modest operational concentration risk. The organization-backed repository provides some compensation, but publishing access still depends on a single account.

Release historycaution

The project has 32 releases over about three years, but it has made no release in the last 12 months; the latest release was about 16 months ago. This is a meaningful maintenance concern despite the historically frequent release interval.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the long gap since the latest registry release, this raises abandonment and response-time concerns.

Repo issue activitycaution

The repository has 15 open issues and 5 open pull requests, but no new or closed issues and no merged pull requests in the last month. This suggests limited recent maintenance attention.