react-draggable

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing was reported, so consumers have limited cryptographic evidence connecting the artifact to its source build.

Repo bus factorcaution

One contributor made 7 of 9 recent commits, so activity is concentrated; however, two additional contributors remained active and the repository is organization-owned, which provides some handoff capacity.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, tsup, webpack, and esbuild. No security-scanning tools were detected, leaving a modest transparency gap.

Security policycaution

No repository security policy was found, so the project does not clearly document how security issues should be reported.

Token permissionscaution

One workflow lacks top-level permissions and another declares top-level write access, which is weaker least-privilege hygiene than explicit read-only or narrowly scoped permissions.