This release appears healthy and suitable to depend on. It is an established, stable MIT-licensed type-definition package with a clean four-file artifact, no install-time lifecycle scripts, a direct dependency on @types/react, and current publication activity. Its linked DefinitelyTyped repository is active, well-backed by an organization, extensively contributed to, security-aware, and free of the analyzed dangerous workflow patterns. The lack of package-specific tests and changelog in the artifact is compensated by repository tests and GitHub Releases; the absent build attestation and registry maintainer count are transparency limitations but not strong evidence of abandonment or unfitness.
92%
Total Score
100
100
100
90
50
No build attestation or trusted-publisher provenance is present, which is a transparency gap, though the package's simple generated declaration artifact and active source project reduce the maintenance concern.
Five workflows declare read-only permissions and none declare top-level write permissions; two omit top-level permissions, leaving a minor configuration gap.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@types/react Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.