react-scripts

Build provenancecaution

No build attestation or staged publishing was observed, leaving the connection between the published artifact and its source less transparent. The linked repository and release documentation provide some compensating context, so this is not a severe risk by itself.

Dependency profilecaution

The package declares 48 runtime dependencies for its build-tooling role, creating a broad maintenance and transitive dependency surface. This is partly expected for a bundled application toolchain, but it raises ongoing upkeep burden.

Release historycaution

The package has 136 releases over roughly 10 years, but it has had no releases in the last 12 months; the latest release was about 19 months ago. Its long history partly offsets the recent release gap.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, which is meaningful evidence of currently limited maintenance capacity.

Workflow auditcaution

All 8 analyzed action references are unpinned, and a high-confidence template-injection finding was reported in the end-to-end workflow. The audit was complete and found no untrusted checkout or script-injection paths, but the workflow hygiene still warrants caution.