react-resizable

Name lookalikedanger

The package borrows the identity of the much more established react-is package, with borrows_lookalike_identity true and no declared fork relationship. Consumers may have intended react-is instead, making this a serious supply-chain concern.

Repo issue activitycaution

Only 2 issues and 10 pull requests are open, but there was no issue or pull-request activity in the last month. This is a minor maintenance caution, tempered by recent commits and releases.

Repo toolingcaution

The project uses TypeScript, webpack, Babel, and npm scripts for builds, demonstrating established tooling. No security scanning tools were detected, which is a modest transparency gap.

Security policycaution

The repository has no security policy. This does not show unsafe code, but it leaves vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All 5 workflows were analyzed with no high- or medium-severity findings and no untrusted checkout or script-injection paths. However, all 9 action references are unpinned and one workflow has top-level write permissions, creating a workflow-hygiene concern.