its-fine

A collection of escape hatches for React.

Latest 2.1.1

72%

Total Score

caution

Usable with caveats: the release is current, but recent repository commit activity is absent and workflow hygiene is incomplete.

Health Score Breakdown

Build provenance

No build attestation, trusted publisher, or staged publishing is reported, leaving the connection between the source and published artifact less transparent.

Repo commit activity

No commits or active maintainers were recorded in the last three months, which is a maintenance concern, although the recent release and merged pull requests partly compensate for it.

Repo tooling

The repository uses TypeScript, Vite, and npm scripts, but no security scanning tools are configured, leaving a modest tooling gap.

Security policy

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers or script-injection findings, but both action references are unpinned and it installs a package outside the lockfile. The high-confidence adhoc-packages finding and incomplete pinning weaken workflow reproducibility.