react-window

Name lookalikedanger

The package is flagged as borrowing the identity of react-is, with borrows_lookalike_identity true. Although artifact overlap is 0 and the README does not identify it as react-is, the identity signal is still severe under the assessment rules.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor activity is not offset by visible organizational handoff capacity.

Repo bus factorcaution

One contributor made 17 of 19 recent commits, or about 89%, leaving maintenance heavily concentrated despite two additional active contributors.

Repo toolingcaution

The project uses TypeScript, Vite, Vitest, Rollup, SWC, and npm scripts, showing a substantial build and test toolchain. No security scanning tools were detected, which is a modest transparency gap.

Security policycaution

The repository has no security policy, so users have no documented security-reporting process. This is a transparency gap, but it is outweighed partly by the project's active development and testing evidence.