@react-stately/dnd

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers have less independent evidence connecting the published artifact to its source build. This is a transparency gap, but the active organization-backed repository partly compensates for it.

Dangerous workflowscaution

One of eight workflows uses pull_request_target, which warrants review because that trigger can expose elevated workflow context. However, no untrusted checkouts or script-injection patterns were detected.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @react-stately/dnd, so the link does not independently prove package-specific ownership. The mismatch is consistent with a monorepo, but it remains a transparency caution.

Token permissionscaution

Five workflows declare read-only permissions and none declare top-level write permissions. Three workflows lack top-level permission declarations, so their effective permissions are less explicit than ideal.

Version stabilitycaution

Version 3.8.1 is a stable, non-prerelease major version, although all recent releases are marked prereleases, which adds a small stability concern.