@react-native-community/cli-config

Build provenancecaution

No build attestation or staged-publishing provenance is present, which limits release verification, but this is a transparency gap rather than evidence that the release is unfit.

Dangerous workflowscaution

One of four workflows uses pull_request_target, which deserves care because it can run with elevated repository context; no untrusted checkout or script-injection pattern was detected.

Repo bus factorcaution

All recent commits come from one contributor, creating concentration risk; the organization-owned repository provides some capacity to hand maintenance off, which keeps this from being severe.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months from 1 active maintainer, which is a meaningful recent-maintenance concern despite the continuing release history.

Repo toolingcaution

The repository uses TypeScript, Babel, and npm build tooling, but no security-scanning tool was detected, leaving a modest security-process gap.