react-promise-suspense

Name lookalikedanger

The package borrows the identity of the much more established react-is package, with 13 million versus 1.3 billion monthly downloads and no transparent fork relationship. Consumers may have intended to select react-is instead, making this a severe dependency-selection risk.

Build provenancecaution

No build attestation, trusted publisher, or staged publishing provenance is available, limiting verification of how the artifact was produced.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer reflects a genuinely narrow apparent backing base.

Release historycaution

The package has only seven releases and no releases in the last 12 months; its latest registry release was in February 2023, indicating a substantial release gap for a library dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, so recent repository activity does not compensate for the long release gap.