@react-stately/toast

Build provenancecaution

The release has no build attestation or trusted-publisher metadata. This is a transparency gap, but the package otherwise shows strong release and repository activity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @react-stately/toast. Although a name mismatch is normal for a monorepo, the lack of an explicit package mention warrants caution about repository linkage.

Workflow auditcaution

All eight workflows were analyzed with no failed files, dangerous sinks, or audit findings, and permissions are scoped or read-only in the observed workflows. However, all 15 action references are unpinned, leaving a workflow supply-chain hygiene gap.