@vis.gl/react-mapbox

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating a transparency concern about the exact package-to-repository relationship. The mismatch may be consistent with a monorepo, but the absent README mention leaves the concern unresolved.

Repo toolingcaution

The repository uses TypeScript and Vitest with an established build tool, but no security-scanning tool was detected; this is a modest security-process gap rather than a maintenance failure.

Token permissionscaution

Two of three workflows lack top-level token-permission declarations, although none declares top-level write permissions and one workflow has read-only permissions; the incomplete least-privilege declaration warrants caution.