react-hot-toast

Name lookalikedanger

The signal says this package borrows the identity of the much more established react-is, with borrows_lookalike_identity true. Under the supplied rule, that is strong evidence consumers may have intended react-is instead, making this a severe supply-chain concern.

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving the relationship between the source and published artifact less transparent.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing to compensate for concentrated maintenance.

Release historycaution

The package is mature, released over about 5 years, and has a latest release today; however, only one release appeared in the last 12 months, so the current release is positive evidence but not a strong cadence signal.

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance dependency and increasing abandonment risk for a user-owned project.