chromatic

Maintainerscaution

The package has 10 registry maintainers and clear Chromatic organization backing. Several publish accounts use personal or outside domains—codykaup, shilman, ndelangen, andrewortwein, tevanoff, tmeasday, and jmhobbs—creating account-hygiene risk, though this does not indicate a thin maintenance team.

Workflow auditcaution

All 11 workflows were analyzed successfully, with no high- or medium-severity findings and nine workflows using read-only permissions. However, all 22 action references are unpinned, two workflows grant top-level write access, and the release workflow installs a package outside a lockfile, creating moderate workflow reproducibility and supply-chain hygiene concerns.