react-virtuoso

Name lookalikedanger

The detector says react-virtuoso borrows react-is's identity, which is strong evidence of a lookalike package; consumers seeking react-is could select the wrong dependency.

Project backingcaution

The repository is owned by a user rather than an organization, so the concentrated maintainer activity and single registry publisher provide less organizational handoff capacity.

Repo bus factorcaution

The primary contributor made about 73% of recent commits, creating concentration risk, although 8 contributors were active during the period.

Security policycaution

The repository has no security policy, which weakens disclosure guidance and project transparency, though it does not outweigh the active maintenance evidence.

Workflow auditcaution

All four workflows were analyzed, use read-only permissions, and pin all 38 action references. Two high-confidence low-severity findings install packages outside a lockfile, a modest workflow hygiene concern.