react-focus-lock

Name lookalikedanger

The package is flagged as borrowing react-is's identity, which has vastly more downloads; this is strong evidence that consumers could choose the wrong package, even though artifact overlap is zero.

Build provenancecaution

This release has no build attestation or trusted-publisher metadata, so consumers cannot verify how the artifact was produced.

Maintainerscaution

Only one registry account has publishing access, creating a thin publishing base; the linked repository is user-owned rather than organization-backed, so no compensating backing is shown.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating a meaningful maintenance-capacity gap despite a recent repository push.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented.