react-input-autosize

Name lookalikedanger

The signal says this package borrows the identity of the much more established react-is, despite no artifact overlap; consumers may have intended to install react-is instead. This is a serious supply-chain and package-selection risk.

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent. This is a supporting transparency weakness, not a health verdict on its own.

Release historycaution

The package has 47 releases since October 2014, but none in the last 12 months; its latest registry release was in December 2020. The long gap materially increases abandonment risk.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with the release gap. This weakens evidence of ongoing maintenance.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a hygiene gap alongside the stronger maintenance concerns.