@react-pdf/renderer

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer and publishing structure has less organizational redundancy than an organization-backed project.

Repo toolingcaution

The repository uses established build and test tools including Vitest, Babel, Rollup, npm scripts, and TypeScript. No security scanning tools were detected, leaving a modest process gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less transparent for a widely used library.

Workflow auditcaution

All 19 analyzed action references are unpinned, and the release workflow installs packages outside a lockfile twice. No untrusted checkout, script injection, high-severity finding, or broad top-level write permission was detected, limiting this to a hygiene caution.