react-i18next

Build provenancecaution

No build attestation or trusted-publisher identity is present. This reduces publication transparency, but it is a provenance gap rather than evidence that the release is unsafe or abandoned.

Lifecycle scriptscaution

The package has a prepare install-time script. This adds some installation complexity, but the repository-backed build and otherwise transparent package contents provide context for it.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts, script injection, or write-all token permissions. However, all 11 action references are unpinned and high-confidence findings show packages installed outside a lockfile, so workflow reproducibility has a modest hygiene weakness.