react-native-keyboard-controller

Lifecycle scriptscaution

A prepare install-time script is present. This adds build-time execution during installation, although no other provided signal indicates that the script is unsafe.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the concentrated commit activity and single registry maintainer are not offset by visible organizational backing.

Repo bus factorcaution

One contributor made 40 of 56 recent commits, or about 71%, creating meaningful concentration risk. However, 12 other contributors were active during the same period, partly compensating for that concentration.

Repo toolingcaution

The project uses TypeScript, Babel, and npm build tooling, but no security scanning tools were detected. This is a modest repository-hygiene gap rather than evidence of abandonment.

Workflow auditcaution

All 118 analyzed action references are unpinned, and the audit found a medium-confidence template-injection finding plus four high-confidence adhoc-package findings. The pull_request_target and workflow_run triggers have no untrusted checkouts or script-injection counts, so these are workflow-hygiene concerns rather than a severe risk.