react-tooltip

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less evidence tying the published artifact to its source build.

Repo toolingcaution

The project uses TypeScript, Rollup, esbuild, and npm build tooling, showing a structured build process; no security-scanning tool was detected, which is a minor transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All four workflows were analyzed cleanly with no reported findings or untrusted checkouts, but all seven action references are unpinned, weakening build reproducibility and update safety.