react-innertext

Name lookalikedanger

The name resembles the far more established react-is package, and borrows_lookalike_identity is true. This is strong evidence that consumers may have intended to install react-is instead, making this a severe supply-chain and adoption risk.

Build provenancecaution

No build provenance attestation or trusted-publisher metadata is available. This reduces publication transparency, although it is not by itself evidence that the package is unsafe.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-publisher context provides limited visible organizational continuity.

Release historycaution

The package has six releases over about eight years, but none in the last seven years; the latest release was published in June 2019. That long registry gap materially increases abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This supports the registry evidence of a currently inactive project.