@react-types/searchfield

Build provenancecaution

No registry build attestation or trusted-publisher identity is present. This is a transparency limitation, but it is outweighed by the package's long, frequent release history and active source repository.

Dangerous workflowscaution

One of eight workflows uses pull_request_target, which warrants some caution, but none use untrusted checkouts or detected script injection. The observed workflow profile is not a severe health risk.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package. This is a transparency caution under the supplied rule, although the package README explicitly identifies it as part of react-spectrum, making a monorepo relationship plausible.