react-highlight-words

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the artifact was produced.

Project backingcaution

The source repository is owned by an individual rather than an organization, so the single-contributor maintenance concentration is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all three commits in the last three months, leaving recent maintenance dependent on a single person.

Repo commit activitycaution

There were three commits in the last three months, showing recent activity, but the volume is limited and should be read alongside the contributor concentration.

Repo toolingcaution

The project uses TypeScript, Vite, Vitest, Rollup, SWC, and npm scripts, but no security-scanning tool was detected, leaving a modest transparency gap.