react-calendar

Project backingcaution

The repository is owned by a user rather than an organization, so the single-contributor concentration is a meaningful continuity concern rather than something clearly covered by organizational backing.

Repo bus factorcaution

One contributor made all eight commits in the last three months, concentrating maintenance responsibility and increasing continuity risk for a user-owned project.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security scanning tool was detected. The missing scanner is a modest transparency gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented for users and maintainers.

Workflow auditcaution

All workflows were analyzed and had no untrusted checkouts or script-injection findings, but all 14 action references are unpinned and one workflow grants top-level write access. The low-confidence cache finding is hygiene rather than a standalone severe risk.