react-textarea-autosize

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving the registry artifact's build origin less transparent. This is a supply-chain hygiene gap, not evidence that the release is unsafe.

Lifecycle scriptscaution

A prepare script runs during installation or packaging. This is common for JavaScript packages but adds executable install-time behavior that deserves routine review.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the project has a narrower visible backing structure.

Release historycaution

The package has a long history with 104 releases, but it has had no registry release in about 18 months. That combination suggests maturity with a meaningful maintenance slowdown.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Together with the absent releases in the last 12 months, this raises abandonment risk.