react-loading-skeleton

Name lookalikedanger

The signal reports that the name borrows the identity of the far more established react-is package. With borrows_lookalike_identity true, consumers could be selecting the wrong package despite no artifact overlap.

Build provenancecaution

The release has no build attestation, trusted publisher, or staged publishing record, reducing publication transparency.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing signal to offset the thin maintenance activity.

Release historycaution

The package has 32 releases over more than nine years, but its latest registry release was nearly two years ago and it had no releases in the last 12 months.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, weakening evidence of active maintenance despite the recent push timestamp.