@react-email/img

Registry deprecationdanger

NPM marks the entire package as deprecated with the message “Package no longer supported,” making this release a severe adoption risk despite activity in the linked repository.

Build provenancecaution

No build provenance attestation or trusted publisher identity is present, leaving publication origin less independently verifiable; this is secondary to the explicit package deprecation.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkouts, script injections, or unpinned actions. The audit found a high-confidence template-injection hygiene issue and an informational trusted-publishing finding, but no direct release-blocking workflow weakness was shown.