react-use

Name lookalikedanger

The package borrows the identity of the far more established react-is, with borrows_lookalike_identity true. Although artifact overlap is 0 and the README identifies react-use, this remains strong evidence of consumer confusion and is a severe risk.

Build provenancecaution

No build attestation or trusted-publisher provenance was found. This limits release transparency, although it is not by itself evidence that the package is unsafe.

Dependency profilecaution

The package declares 14 runtime dependencies and 58 development dependencies, a moderate runtime footprint for a broad React hooks collection. The dependency count adds some maintenance surface but is not excessive on its own.

Project backingcaution

The repository is owned by the individual account streamich rather than an organization. That does not establish abandonment, but it offers less visible organizational backing for a package with a large maintenance backlog.

Release historycaution

The project has existed for 2885 days and published 273 releases, but only one release appeared in the last 12 months. That recent slowdown lowers confidence in ongoing maintenance.