@react-native-community/cli-tools

Repo bus factorcaution

All recent repository commits came from one contributor, leaving a concentrated short-term maintenance base; organization backing provides some ability to hand work off.

Repo commit activitycaution

Only 1 commit from 1 active maintainer was recorded in the last 3 months, indicating weak recent maintenance activity despite the package's strong longer-term release history.

Repo package mentioncaution

The repository name differs from this package and its README does not mention the package, creating some uncertainty about package-to-repository correspondence; the monorepo and organization backing partly explain the mismatch.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All 15 action references are unpinned, and the audit found a high-confidence template-injection issue; the finding is in a different workflow from the pull_request_target trigger, so this is workflow hygiene rather than a standalone severe risk.