@react-aria/select

Build provenancecaution

No build attestation or trusted-publisher provenance was found, leaving publication origin less independently verifiable despite the package's otherwise strong maintenance evidence.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @react-aria/select, so package ownership is less directly transparent; the monorepo context reduces but does not remove this concern.

Workflow auditcaution

All eight workflows were analyzed with no reported audit findings, and permissions are read-only or job-scoped where specified. However, all 15 analyzed action references are unpinned, leaving a workflow supply-chain hygiene gap.