@react-aria/tooltip

Build provenancecaution

No registry build attestation or trusted-publisher information is present. This limits release transparency, though the active repository and extensive release history provide compensating maintenance evidence.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @react-aria/tooltip. Although a monorepo name mismatch is normal, the lack of a package mention leaves some uncertainty about direct repository attribution.

Workflow auditcaution

All eight workflows were analyzed with no findings, no untrusted checkouts, no script injection, and mostly scoped or read-only permissions. However, all 15 action references are unpinned, a modest reproducibility and update-integrity concern.