@react-stately/color

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers receive less verification of how the artifact was produced. This is a supply-chain transparency gap, but it is outweighed by the active, organization-backed project evidence.

Dangerous workflowscaution

One of eight workflows uses pull_request_target, which warrants some review because it can operate with elevated trust. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @react-stately/color, creating a package-to-source transparency concern. Because the repository is a large react-spectrum monorepo, the mismatch is plausibly normal but remains a caution.

Token permissionscaution

Five workflows declare read-only permissions and none declare top-level write permissions. Three omit top-level permissions, leaving some workflow privilege behavior less explicit but not showing excessive declared access.