@react-spring/types

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so package ownership is less transparent. The organization-owned monorepo context makes a subpackage plausible but does not remove the mismatch entirely.

Repo toolingcaution

The project uses established build and test tooling, including TypeScript, Vitest, Turbo, Vite, and SWC. No security-scanning tooling was detected, leaving a modest hygiene gap.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, though active development and provenance provide some compensating evidence.

Workflow auditcaution

All 42 analyzed action references are unpinned, and three high-confidence low-severity findings report packages installed outside lockfiles; one workflow also has top-level write permissions. No dangerous trigger or untrusted checkout was found, so this is a hygiene caution rather than a critical workflow risk.