react-devtools-core

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is recorded, leaving release provenance less verifiable than it could be.

Dangerous workflowscaution

Four workflows use pull_request_target and two use workflow_run, which warrants workflow review, but there are no untrusted checkouts or detected script-injection patterns to elevate this to a severe concern.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding some release-process complexity, but this signal alone does not establish a maintenance or dependency-safety failure.

Repo package mentioncaution

The linked repository name does not match react-devtools-core and its README does not mention the package. Although a monorepo can legitimately contain subpackages, this lack of an explicit package reference makes the source relationship harder to verify.