@svgr/babel-plugin-add-jsx-attribute

Build provenancecaution

No build attestation or trusted-publisher information was detected. This reduces publication transparency, although it is not by itself evidence that the release is unsafe.

Maintainerscaution

Only one account has registry publish access. The linked repository is user-owned rather than organization-owned, so there is little provided evidence of publishing redundancy.

Project backingcaution

The package uses the @svgr namespace and links to the broader SVGR repository, but the repository owner is an individual account rather than an organization. This provides project context without strong organizational backing evidence.

Release historycaution

The latest release was about three years ago, with no releases in the last 12 months, despite a history of 13 releases. This is meaningful staleness for a dependency, though the long-lived release history provides some maturity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Combined with the old registry release, this raises abandonment and responsiveness concerns.