react-popper-tooltip

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less transparent. The package still includes a coherent built artifact and matching repository, which partly offsets this gap.

Release historycaution

The package has 78 releases since August 2018, but its latest release was in June 2022 and there were no releases in the last 12 months. This materially raises maintenance and abandonment concerns.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last 3 months, which provides little evidence of current maintenance capacity.

Security policycaution

The repository has no security policy or security-scanning tools. This is a transparency and response-process gap, though it does not by itself indicate unsafe code.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, but both action references are unpinned. That is a workflow reproducibility and supply-chain hygiene gap, not a severe risk by itself.