react-remove-scroll-bar

Build provenancecaution

No build attestation or trusted-publisher provenance is available, limiting publication transparency, though this is a transparency gap rather than evidence of unsafe code.

Lifecycle scriptscaution

A prepublish lifecycle script is present, adding a small amount of publishing complexity, but this single script is not by itself a severe dependency risk.

Maintainerscaution

Only one registry publishing account is listed, creating some operational concentration risk; the linked repository provides additional evidence of an established project but not a broader publisher base.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer is not supported by visible organization backing.

Release historycaution

The package has 20 releases over about 7 years, but no releases in the last 12 months and its latest release was about 21 months ago, indicating a significant maintenance slowdown.