react-scroll

Name lookalikedanger

The package borrows the identity of react-is, which has far greater adoption, and the detector marks the identity signal as true. With no self-described fork or artifact overlap, this is a severe dependency-selection risk.

Build provenancecaution

No build provenance attestation or trusted-publisher identity is present, so consumers cannot verify how the registry artifact was produced. This is a transparency gap that adds some supply-chain uncertainty.

Maintainerscaution

Only one account has registry publishing access, which creates a thin publishing base. The linked repository is also user-owned, so no organization backing is shown to compensate for that concentration.

Release historycaution

The package has 120 releases over more than 11 years, but none in the last 12 months; the latest release was about 19 months ago. Its long history helps, but the current pause lowers confidence in active maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating no recent development activity. The non-archived status and recent release history partly compensate but do not remove the maintenance concern.