react-ace

Name lookalikedanger

The package is reported to borrow the identity of the far more established react-is, with borrows_lookalike_identity true. This is strong evidence that consumers may have intended to install react-is, so the signal is a severe supply-chain concern.

Lifecycle scriptscaution

A prepare install-time script is present. This is a mild packaging and supply-chain consideration, but the available build and provenance evidence provides context for a normal build workflow.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the small maintainer base and concentrated recent commits are not offset by clear organizational handoff capacity.

Repo bus factorcaution

Two contributors were active recently, so the project is not entirely dependent on one person; however, one contributor made 7 of 9 commits, leaving meaningful concentration risk.

Repo issue activitycaution

The repository has 13 new pull requests in the last month, although none were merged and issue closure was inactive, suggesting some process sluggishness.