react-spring

Name lookalikedanger

The package is flagged as borrowing the identity of the far more established react-is, with borrows_lookalike_identity true. Although artifact overlap is 0 and the repository identifies as react-spring, the naming evidence creates a severe adoption risk for consumers who intended react-is.

Release historycaution

The package has existed for about 8.5 years with 393 releases, but only 2 releases in the last 12 months. Long-term history compensates for some of the recent slowdown, but the current cadence warrants caution.

Repo toolingcaution

The project uses established build and test tools, including TypeScript and Vitest, but no security scanning tools were detected. The tooling supports maintenance while leaving a security-hygiene gap.

Security policycaution

The repository has no security policy. That reduces transparency for reporting and handling vulnerabilities, though it does not by itself show abandonment.

Workflow auditcaution

All 7 workflows were analyzed with no untrusted checkouts or script injection, and only one workflow has top-level write permissions. However, all 42 action references are unpinned and three high-confidence audits found ad hoc package installation, creating workflow hygiene risk.