react-konva

Build provenancecaution

The release has no build attestation, trusted publisher identity, or staged-publishing evidence, so consumers have less independent assurance about how the artifact was produced.

Repo bus factorcaution

One contributor made all 9 commits in the last 3 months, creating a real continuity risk despite the repository being owned by an organization.

Repo toolingcaution

The repository uses TypeScript, Vitest, Vite, and npm build scripts, but no security scanning tools were detected; the build and test tooling is solid while security-tooling coverage is limited.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response guidance less transparent than it could be.

Token permissionscaution

Neither workflow declares top-level token permissions. No workflow requests top-level write access, but the absence of explicit restrictions leaves CI permission scope less transparent.