react-table

Name lookalikedanger

The package is identified as borrowing the identity of react-is, which has far greater monthly downloads, despite no artifact overlap or self-described fork. Consumers may have intended react-is, making this a serious identity risk.

Lifecycle scriptscaution

The package uses a prepare script during installation. This adds build-time behavior that deserves attention, but the signal alone does not show harmful or unnecessary execution.

Release historycaution

The package has 217 releases and a long history, but it has had no registry release in over four years. Active repository work partly offsets abandonment concerns, but does not prove this published version is current.

Repo bus factorcaution

One contributor made about 85% of recent commits, which is concentrated, but seven other contributors were active and the repository is organization-owned. The organization provides some handoff capacity, so this is only a moderate concern.

Security policycaution

The repository has no security policy. This is a transparency gap, though the repository's active maintenance and security scanning provide partial compensation.