@reactflow/node-toolbar

Release historycaution

The package has had no registry release in roughly two years, despite 40 releases overall and a previously regular cadence. This raises version staleness risk for a dependency, although active repository work partly offsets abandonment concerns.

Repo package mentioncaution

The repository name differs from the package name and its README does not mention this package, so the package-to-repository relationship is less transparent. The organization-backed monorepo context partly explains the name mismatch but does not resolve the missing mention.

Workflow auditcaution

All six action references are unpinned, and the audit found a high-confidence template-injection issue; the repository also has one workflow with top-level write permissions. No untrusted checkout or script-injection trigger was found, so these are hygiene and review concerns rather than an immediate severe risk.