lottie-react

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving release-to-source provenance less transparent.

Maintainerscaution

Only one registry account, gamote, has publish access. This is a resilience concern for publishing continuity, although the repository shows active maintenance by the same project owner.

Project backingcaution

The repository is owned by a user account rather than an organization, so there is no organizational backing to compensate for the concentrated maintainer and publishing base.

Repo bus factorcaution

All 32 recent commits came from one contributor with a 100% share, creating a meaningful single-maintainer continuity risk without organizational backing.

Repo toolingcaution

The repository uses TypeScript and Vitest build tooling, but no security-scanning tools are configured; the missing scanning is a transparency and defense-in-depth gap.