react-datepicker

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, though the release has a long history and a matching, organization-backed repository.

Lifecycle scriptscaution

A prepare script runs during installation or package preparation. This is not necessarily unsafe, but it adds install-time execution that consumers should account for.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push timestamp is a compensating freshness signal, but the lack of observed commit activity still lowers maintenance confidence.

Repo issue activitycaution

The repository still receives issues and pull requests, although no pull requests were merged in the last month, suggesting some backlog risk.

Workflow auditcaution

All six workflows were analyzed successfully with no untrusted checkouts, script injection, or audit findings. However, all 18 action references are unpinned, which leaves build inputs less reproducible and warrants caution.