@react-native/js-polyfills

Repo package mentioncaution

The repository name does not match the package and its README does not mention @react-native/js-polyfills. Although a monorepo subpackage can normally differ in name, the lack of a README mention creates some package-to-repository ambiguity.

Security policycaution

The repository has no detected security policy. This is a transparency and incident-reporting gap, although the active project provides some compensating maintenance evidence.

Version stabilitycaution

Version 0.87.1 is not a prerelease, but the package remains below major version 1 and all recent versions are prereleases by the collected metric. This adds a modest stability caveat.

Workflow auditcaution

The audit found 93 of 100 action references unpinned, several high-confidence template-injection findings, and inherited secrets; it also analyzed only 30 of 36 workflows. No untrusted checkout or script-injection sink was reported, so these are workflow-hygiene concerns rather than a standalone severe risk.