eslint-plugin-react-refresh

Repo toolingcaution

The repository uses TypeScript, Vite, and npm build tooling, but no security-scanning tools were detected. The missing scanning is a modest transparency gap, not a severe health risk given the other maintenance evidence.

Token permissionscaution

One workflow lacks top-level permissions and the publishing workflow grants write permissions. This is a real workflow-hardening gap, although the separate dangerous-workflow checks found no unsafe checkout or injection patterns.