@react-native/eslint-config

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. This is plausible for a monorepo subpackage, but the collected evidence does not directly connect the artifact to the repository.

Repo toolingcaution

The repository uses Babel, TypeScript, and npm scripts, but no security-scanning tools were detected. The missing scanning layer is a modest governance gap, partly offset by the active organization-backed project.

Security policycaution

No repository security policy was detected, leaving vulnerability-reporting expectations unclear. Active maintenance and organizational backing provide some compensation but do not remove the transparency gap.

Version stabilitycaution

Version 0.88.0 is not itself a prerelease, but 95% of recent releases are prereleases, indicating a development-heavy release stream and some versioning uncertainty.

Workflow auditcaution

The audit found 88 of 95 action references unpinned, 24 high-confidence findings, floating container images, template-injection findings, and inherited secrets in the publishing workflow. Pull request triggers had no untrusted checkouts or script-injection sinks, which limits the risk but does not offset the broad hygiene problems.