@react-aria/color

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving publication provenance less transparent; the package's active repository and release history provide partial context but do not replace attestations.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @react-aria/color; this is a caution because the package-to-repository relationship is less explicit, although it is consistent with a monorepo subpackage.

Workflow auditcaution

All eight workflows were analyzed with no audit findings, no untrusted checkout or script-injection sinks, and read-only or job-scoped permissions in the observed workflows. However, all 15 action references are unpinned, which is a supply-chain hygiene caution.