highcharts-react-official

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent, though this is not by itself evidence of an unhealthy release.

Repo package mentioncaution

The repository name does not exactly match the package name and its README does not mention the package, so the linkage is less transparent even though the repository is clearly organized under the expected project owner.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tools were detected. The missing scanning automation is a minor hygiene gap rather than a maintenance failure.

Security policycaution

No repository security policy was found, reducing transparency for reporting and handling vulnerabilities.

Workflow auditcaution

The single workflow was fully analyzed, uses two pinned actions, and has no untrusted checkout or script-injection findings. Its top-level write permission is broader than necessary, so it is a mild workflow-hygiene concern.