@react-aria/switch

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving the exact registry-to-source build path less transparent despite the otherwise active project.

Dangerous workflowscaution

One of eight workflows uses pull_request_target, which warrants review because it can run with elevated repository context. However, no untrusted checkouts or script-injection patterns were detected.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. A monorepo mismatch is ordinary, but the lack of an explicit README reference leaves a modest identity-transparency concern.

Token permissionscaution

Five workflows declare read-only permissions and none declare top-level write permissions. Three workflows omit top-level permissions, leaving a modest workflow-hardening gap but no demonstrated excessive write access.