@rive-app/react-canvas

Repo bus factorcaution

All 20 recent commits came from one contributor, zplata, with one active maintainer and no second recent contributor shown; organization backing provides some continuity but does not remove this concentration risk.

Repo package mentioncaution

The repository name does not match this package and its README does not mention @rive-app/react-canvas. While a monorepo sub-package can have a different repository name, the lack of a README mention weakens package-to-source transparency.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and Babel, but no security scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and handling.

Workflow auditcaution

All 5 analyzed action references are unpinned, and the publish workflow has a high-confidence template-injection finding plus a low-confidence hygiene finding for installing packages outside a lockfile. No untrusted checkout or script-injection sink was found, so this is a caution rather than a severe workflow risk.