@react-stately/tooltip

Build provenancecaution

No build attestation or trusted-publisher metadata is present, so the release's publication provenance is less transparent than it could be; the active organization-backed project provides partial context but not verification.

Repo package mentioncaution

The linked repository name differs from the package and its README does not mention @react-stately/tooltip, leaving package-to-repository identification less transparent; this can occur with monorepos but remains a caution.

Workflow auditcaution

All eight workflows were analyzed without failed files or audit findings, and permissions are generally scoped or read-only; however, all 15 action references are unpinned, creating a workflow supply-chain hygiene gap.