react-base16-styling

Build provenancecaution

The release has no attestation or trusted-publisher provenance. This reduces publication transparency, though it is not by itself evidence that the package is unsafe.

Lifecycle scriptscaution

A prepublish script is present, creating a small release-process surface to review, but this alone does not indicate unhealthy maintenance.

Release historycaution

The package has 25 releases over more than 10 years, but its latest release was April 7, 2024 and there were no releases in the last 12 months. That is a meaningful freshness concern for a dependency.

Repo package mentioncaution

The linked repository name does not match react-base16-styling and its README does not mention the package, so the package-to-source relationship is not transparently established. This is a material supply-chain transparency concern.

Repo toolingcaution

The project uses Vitest, npm scripts, and TypeScript, providing a maintained build and test toolchain. No security scanning tools are reported, leaving a minor hygiene gap.