@react-native/dev-middleware

Dangerous workflowscaution

Two pull_request_target workflows and one workflow_run workflow warrant review because these event types can carry elevated execution risk, although no untrusted checkouts or script-injection patterns were detected.

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, which creates a package-identification gap; however, the linked repository is an organization-owned monorepo, making a name mismatch ordinary for a sub-package.

Repo toolingcaution

The project uses Babel, TypeScript, and npm build tooling, but no security scanning tools were detected, leaving a real supply-chain hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Token permissionscaution

Eleven workflows lack top-level permissions and eight declare top-level write access, which is broader workflow permission hygiene than ideal, though 11 workflows use read-only permissions.