oxlint-plugin-react-doctor

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the package-to-repository link is not directly established. A monorepo can explain a name mismatch, but the missing README mention remains a transparency concern.

Repo toolingcaution

The project uses TypeScript, Vite, Turbo, and npm scripts, showing a structured build process. No security-scanning tools were detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy. That does not show an immediate dependency failure, but it weakens the project's documented process for receiving and handling vulnerabilities.

Version stabilitycaution

Version 0.9.18 is not a stable major and 95% of recent releases are prereleases, so the API may still change frequently. That is a meaningful maturity concern, though the assessed version itself is not marked prerelease.

Workflow auditcaution

All eight workflows were analyzed with no untrusted checkout or script-injection findings, and seven use read-only permissions. However, 28 of 41 action references are unpinned and high-confidence audits found ad hoc package installs; these are avoidable workflow supply-chain hygiene gaps, while trusted publishing was only informational.