react-syntax-highlighter

Build provenancecaution

This release has no build attestation or trusted-publisher provenance. That weakens publication transparency, though it is not evidence of a malicious release by itself.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, which is a meaningful maintenance concern despite a recent release and repository push.

Security policycaution

The linked repository has no published security policy, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

Both workflows were analyzed successfully with no injection or high-severity findings, and one scopes permissions at job level. However, all 6 of 6 action references are unpinned, creating a reproducibility and dependency-hygiene gap.