@react-aria/visually-hidden

Build provenancecaution

The release has no build attestation or trusted-publisher metadata, so registry consumers receive less evidence about how the artifact was produced. Strong repository activity and a coherent package tree partly compensate, making this a transparency caution rather than a severe health risk.

Dangerous workflowscaution

One of eight workflows uses pull_request_target, which warrants review because that trigger can expose elevated workflow context; however, no untrusted checkouts or script-injection patterns were detected.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. A name mismatch is normal for a monorepo, but the lack of an explicit README reference leaves package ownership somewhat less transparent.

Token permissionscaution

Five workflows declare read-only permissions, but three workflows have no top-level permissions declaration. This is a minor workflow-hardening gap, with no workflows declaring top-level write access.