@react-native/debugger-shell

Repo package mentioncaution

The repository name differs from this package and its README does not mention the package, creating some ownership ambiguity; however, the package is part of an organization-owned React Native monorepo, where a name mismatch is ordinary.

Repo toolingcaution

The project uses Babel, TypeScript, and npm build tooling, but the collected repository tooling includes no security-scanning tools, leaving a modest transparency gap.

Security policycaution

No repository security policy was found, which makes vulnerability reporting and response expectations less transparent for a widely used project.

Version stabilitycaution

Version 0.87.1 is not a prerelease, but the package remains before 1.0 and all recent releases are prereleases by the indicator’s classification, so compatibility expectations are less mature.

Workflow auditcaution

The audit analyzed 30 of 35 workflows and found 122 of 133 action references unpinned, plus high-confidence template-injection findings and medium-confidence archived-action and inherited-secret findings. No untrusted checkouts or script injections were found, so these are significant hygiene concerns rather than a standalone severe verdict.