react-native-web

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent, but this is a supply-chain transparency gap rather than evidence of abandonment.

Repo toolingcaution

The repository uses npm scripts and Babel for builds, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response.

Type declarationscaution

No type declarations are published, which is a consumer-facing gap for a JavaScript library, though it does not indicate abandonment or unsafe maintenance.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts or script injection, but all 14 action references are unpinned, one workflow grants top-level write access, and a high-confidence low-severity adhoc-packages finding installs outside a lockfile.