clevertap-react-native

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less verifiable despite the package’s established release history.

Maintainerscaution

Six of seven publishing accounts use the clevertap.com domain, consistent with the organization-backed project; the akashvercetti Gmail account is a minor account-hygiene concern.

Security policycaution

The repository has no published security policy, reducing transparency for vulnerability reporting and response.

Workflow auditcaution

The only workflow had no audit findings and no risky triggers or untrusted checkouts, but its single action reference is unpinned, weakening build reproducibility.