react-hook-form

Performant, flexible and extensible forms library for React Hooks

Latest 7.89.0

NPM

92%

Total Score

healthy

Healthy release with sustained maintenance, strong project backing, and only minor workflow pinning concerns.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher metadata is present, leaving publication provenance less independently verifiable despite the otherwise mature project evidence.

Lifecycle scripts

A prepare script runs during installation, adding build or installation behavior that merits awareness, but this is common packaging practice and no stronger adverse evidence is provided.

Workflow audit

All six workflows were analyzed with no audit findings, no untrusted checkout or script-injection paths, and limited write permission exposure. However, all 11 action references are unpinned, leaving a minor supply-chain hygiene gap.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-925158 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. react-hook-form is vulnerable to Prototype Pollution in versions 7.54.0 - 7.80.0.	7.54.0 - 7.80.0	Medium
AIKIDO-2024-10523 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. react-hook-form is vulnerable to Prototype Pollution in versions 2.28.2 - 7.53.2.	2.28.2 - 7.53.2	Medium