react-json-tree

Name lookalikedanger

The signal says the package borrows the identity of the far more established react-is, with borrows_lookalike_identity set to true. That creates a severe risk that consumers intended to select react-is instead.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the connection between the published artifact and its build less transparent.

Lifecycle scriptscaution

A prepublish lifecycle script adds some build-time supply-chain exposure, though the single script is less concerning than install-time execution scripts.

Release historycaution

The package has 60 releases over more than 11 years, but has had no release in the last 12 months; this suggests a slowing release cadence despite the long history.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions react-json-tree in its README, so the package's ownership and source relationship are not fully transparent.