@react-spring/core

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so the package-to-repository relationship is less clear; this can be ordinary for a monorepo but remains a transparency caution.

Repo toolingcaution

The project uses established build and test tooling, but no security-scanning tools were detected, leaving a modest hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency for reporting and handling vulnerabilities.

Workflow auditcaution

All seven workflows were analyzed without high- or medium-severity findings, but all 42 action references are unpinned and three high-confidence audits found ad hoc package installation; one workflow also grants top-level write permission.