react-native-svg

Name lookalikedanger

The package has zero artifact overlap with react-is, but borrows_lookalike_identity is true and the established lookalike has far more downloads. This is strong evidence that consumers may have intended to select react-is instead.

Lifecycle scriptscaution

The package runs a prepare script during installation. This adds installation-time behavior, but the signal does not show that the script is unsafe or unusually broad.

Repo toolingcaution

The project uses TypeScript, Babel, and npm build tooling, but no security scanning tools were detected. The missing scanning is a modest process gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. That reduces transparency for reporting and handling vulnerabilities, although it does not by itself show a maintenance failure.

Workflow auditcaution

All 12 workflows were analyzed with no reported audit findings or untrusted-checkout and script-injection paths. However, 48 of 49 action references are unpinned and one workflow has top-level write permissions, creating workflow hygiene and update risks.