react-element-to-jsx-string

Build provenancecaution

The release has no attestation or trusted-publisher provenance, leaving publication origin less transparent than it could be.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance warning despite the recent package release.

Security policycaution

The repository has no security policy, which leaves vulnerability-reporting expectations unclear, though this is a moderate transparency gap rather than evidence of abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings or untrusted checkouts, but both of its two action references are unpinned, weakening build reproducibility.