@react-types/numberfield

Dangerous workflowscaution

One of eight workflows uses pull_request_target, but none reports untrusted checkouts or script injection, so the observed workflow risk is limited.

Repo package mentioncaution

The linked repository name does not match the package name, which is normal for a monorepo, but its README also does not mention this package, creating a small transparency concern about the exact package-to-repository relationship.

Token permissionscaution

Five workflows declare read-only permissions, but three omit top-level permissions declarations, leaving their default token scope less explicit than ideal.

Version stabilitycaution

Version 3.9.0 is a stable, non-prerelease major version, although the recent prerelease share is reported as 100%, which adds a small stability concern.