@react-native/gradle-plugin

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, so the package-to-repository relationship is not directly established; the monorepo context partly explains the name mismatch but not the missing mention.

Repo toolingcaution

Build tooling is present, but no security-scanning tools were detected, leaving a modest transparency and defensive-hygiene gap.

Security policycaution

No repository security policy was found, which makes vulnerability reporting less transparent for a widely used build component.

Version stabilitycaution

The release is not a prerelease, but the package remains below major version 1 and all recent releases are prereleases by the recorded profile, adding some stability uncertainty.

Workflow auditcaution

The audit is incomplete because only 30 of 35 workflows were analyzed. Of 133 action references, 122 are unpinned, and the audit reports high-confidence template-injection and floating-image findings; no untrusted checkout or script-injection sink was found, so these are workflow-hygiene concerns rather than a standalone severe risk.