emoji-picker-react

React emoji picker: batteries included, or BYOD (bring your own design, design language and design library). Shared keyboard navigation, localization and virtualization across styled, unstyled and composed UIs.

Latest 5.0.0

NPM

82%

Total Score

healthy

Active project with strong release history, but unpinned workflows and a high-confidence template-injection finding reduce confidence.

Health Score Breakdown

Workflow audit

All four workflows were analyzed, but all 28 action references are unpinned. The release workflow also has a high-confidence template-injection finding, while weekly-emoji installs a package outside a lockfile; no untrusted checkout or script-injection sink was found.

Build provenance

No build attestation or trusted-publisher identity is present, leaving the relationship between source and published artifact less independently verifiable.

Lifecycle scripts

A prepare script runs during installation. This is not inherently unsafe, but it adds install-time behavior that consumers should account for.

Maintainers

Only one registry account has publish access. The repository is actively maintained, but publishing remains concentrated in a single account.

Project backing

The repository is owned by a user rather than an organization, so the concentrated maintainer and contributor base is not offset by visible organizational backing.