@react-native/virtualized-lists

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. Because this is an organization-backed monorepo subpackage, the mismatch is understandable, but the missing README mention reduces package-to-repository transparency.

Repo toolingcaution

The project uses Babel, TypeScript, and npm scripts, showing an established build process, although no security-scanning tools were detected.

Security policycaution

No repository security policy was detected, leaving vulnerability-reporting guidance unclear. This is a transparency gap, though the active organization-backed project partly offsets the concern.

Version stabilitycaution

The release is not marked as a prerelease, but all recent versions are reported in the prerelease share, which makes the versioning history less reassuring than the current label alone.

Workflow auditcaution

The audit covered 30 of 36 workflows, found 108 of 117 action references unpinned, and reported high-confidence template-injection and floating-image findings plus inherited secrets. No untrusted checkouts or script-injection findings were reported, so these are workflow hygiene concerns rather than a standalone severe dependency-health verdict.