react-devtools-core

react-devtools-core 8.0.0 appears to be a mature, actively maintained, stable release: it has 161 releases over roughly 9 years, a recent release, a non-deprecated MIT license, substantial recent repository activity, 28 active contributors, organization backing, security scanning, and a security policy. The main concern is transparency of the source linkage: the linked React repository neither matches the package name nor mentions the package in its README, which makes package ownership harder to verify. Missing artifact tests, changelog, type declarations, and build provenance are secondary concerns because repository tests, changelog, and active project tooling are present, while the package is a low-level JavaScript support package.

Latest 8.0.0

NPM

84%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation, trusted publisher identity, or staged publishing is recorded, leaving release provenance less verifiable than it could be.

Dangerous workflows

Four workflows use pull_request_target and two use workflow_run, which warrants workflow review, but there are no untrusted checkouts or detected script-injection patterns to elevate this to a severe concern.

Lifecycle scripts

A prepublish lifecycle script is present, adding some release-process complexity, but this signal alone does not establish a maintenance or dependency-safety failure.

Repo package mention

The linked repository name does not match react-devtools-core and its README does not mention the package. Although a monorepo can legitimately contain subpackages, this lack of an explicit package reference makes the source relationship harder to verify.