@types/react-highlight-words

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent. This is a modest gap, not evidence of unsafe content by itself.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and there are no untrusted checkouts or script-injection findings. Four medium-confidence template-injection findings remain as a minor workflow hygiene concern, but no dangerous trigger or top-level write permission compounds them.