react-stately

Name lookalikedanger

The package is flagged as borrowing the identity of the much more downloaded react-is, with borrows_lookalike_identity true, despite zero artifact overlap. That creates a serious risk that consumers may select the wrong package.

Build provenancecaution

No build attestation or trusted-publisher provenance was reported. This limits publication transparency, though the active organizational repository provides some compensating project context.

Workflow auditcaution

All 15 analyzed action references are unpinned, which weakens build reproducibility and exposes workflows to moving action revisions. The audit is otherwise complete, has no reported findings, scopes permissions in several workflows, and found no untrusted checkout or script injection.