@react-types/table

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less verifiable even though the package has strong maintenance and repository backing.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the package-to-repository relationship is less transparent; the monorepo context partly explains the mismatch but does not remove the caveat.

Workflow auditcaution

All eight workflows were analyzed with no audit findings, no untrusted checkouts, no script injection, and read-only permissions on five workflows. However, all 15 action references are unpinned, which weakens build reproducibility and supply-chain control.