react-measure

Release historydanger

The package has 62 releases and a mature history, but its latest release was in September 2020 with no releases in the last 12 months. This materially raises abandonment risk.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers over the last three months, consistent with the long release gap and indicating inactive maintenance.

Build provenancecaution

No build provenance attestation or trusted publisher is present, so the artifact's build origin is less independently verifiable. This is a supply-chain transparency gap, not proof of maliciousness.

Maintainerscaution

Only one registry account has publish access. With individual repository ownership and no recent commits, this indicates a thin maintenance base, although access records alone do not establish who actively maintains it.

Name lookalikecaution

The detector says the name borrows identity from react-is, but artifact overlap is zero and the linked repository matches react-measure and mentions it in its README. That evidence makes a copied package unlikely, though the naming signal warrants caution.