@react-types/textfield

Build provenancecaution

The release has no registry build attestation or trusted-publisher metadata, reducing publication transparency despite the package's strong maintenance evidence.

Dangerous workflowscaution

One of eight workflows uses pull_request_target, which warrants review because that trigger can have elevated permissions, but no untrusted checkout or script-injection findings were detected.

Repo package mentioncaution

The repository neither matches the package name nor mentions it in the README, creating a package-to-source traceability concern; the package README does identify it as part of react-spectrum, which partially explains the monorepo relationship but does not remove the gap.