@posthog/react

Maintainerscaution

The package has 21 publish accounts, with 11 using the posthog.com domain and clear organization backing. The outside-domain account rauln (raulnegron.me) and consumer-email accounts such as fuziontech, mariusandra, and robbie-c are account-hygiene cautions, not evidence of limited maintenance capacity.

Workflow auditcaution

All 29 workflows were analyzed, all use read-only permissions, and all 182 analyzed action references are pinned. High-confidence findings include blanket GitHub App permissions, spoofable bot conditions, and template injection; these are workflow hygiene concerns without untrusted checkout or script-injection triggers, while adhoc package installs add minor supply-chain exposure.