@react-spring/rafz

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, creating some uncertainty about the package-to-repository link; this is partly consistent with a monorepo sub-package.

Repo toolingcaution

The project uses TypeScript, Vitest, Turbo, Vite, SWC, and npm scripts, showing a structured build and test setup, but no security scanning tools were detected.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

All 34 analyzed action references are unpinned, and high-confidence low-severity adhoc package installs occur in two workflows; no dangerous triggers, untrusted checkouts, or script injections were found.