@tanstack/vue-virtual

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, which creates a minor ownership-transparency gap. The organization-backed repository and package namespace make a monorepo relationship plausible, so this is caution rather than a severe risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Active maintenance and security scanning reduce the concern but do not remove this transparency gap.