react-freeze

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers cannot verify how the published artifact was produced. This is a transparency gap, though not evidence of a defective release.

Lifecycle scriptscaution

A prepare install-time script is present, adding build-time behavior for consumers or installers. No additional evidence shows that it is unsafe, so this is a limited hygiene concern rather than a severe risk.

Release historycaution

The latest registry release was over two years ago, and there were no releases in the last 12 months. Ten releases over the package's lifetime show prior activity, but the current cadence lowers confidence in ongoing maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the repository was pushed recently, the measured development window indicates a meaningful maintenance slowdown.

Repo issue activitycaution

There are 16 open issues and one open pull request, but no new or closed issues or merged pull requests in the last month. This supports the broader picture of limited recent activity.