react-portal

Build provenancecaution

No build provenance attestation or trusted-publisher identity is present, reducing release transparency; the package's matching repository and license provide some independent context but do not replace provenance.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding release-time execution that deserves caution compared with a package without lifecycle hooks.

Maintainerscaution

Only one registry publishing account is listed. Because the repository is user-owned and recent activity is also absent, this provides a thin operational base rather than strong continuity.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no organizational backing signal to offset the thin maintainer base.

Release historycaution

The package has a long history with 56 releases, but it has had no releases in about 20 months, indicating a meaningful slowdown despite its established release record.