react-property

Build provenancecaution

No build attestation or trusted-publisher provenance is present, limiting verification of how the artifact was produced. This is a transparency gap rather than evidence of a bad release.

Maintainerscaution

Only one registry publishing account is listed, creating a thin publishing base. The repository's observed activity provides some compensation, but it does not remove the continuity risk.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing to offset the single-publisher risk.

Release historycaution

The package has 7 releases over about 7 years, but none in the last 12 months and the latest release was on October 22, 2023. That is a meaningful maintenance-staleness concern for a dependency.

Repo commit activitycaution

There were no commits from active maintainers in the last three months, which weakens direct evidence of ongoing development. Recent merged pull requests and the recent repository push partly offset that concern.