react-app-polyfill

Release historycaution

The package has 41 releases over roughly eight years, but none in the last 12 months. That suggests the release line is stable or largely inactive, lowering confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a concrete sign that active development has slowed or stopped.

Repo package mentioncaution

The repository name does not match the package and its README does not mention react-app-polyfill. Although monorepo subpackages can differ in name, this weakens evidence that the linked repository directly represents this package.

Repo toolingcaution

The project uses build tooling, but no security scanning tools were detected. That is a modest transparency and hygiene gap, partly offset by the repository’s security policy.

Workflow auditcaution

All eight analyzed Actions references are unpinned, and the audit found a high-confidence template-injection issue plus high-confidence ad hoc package installation. There are no untrusted checkouts or write-permission workflows, which limits the severity.