reactflow

Build provenancecaution

No build attestation or trusted-publisher provenance is available. This leaves the origin of the published artifact less transparent, although it is not evidence that the release is unsafe.

Release historycaution

The package has 63 releases over more than 12 years, but no registry release in the last 12 months. Active repository work partly offsets this, suggesting the release line may be stable rather than abandoned.

Repo toolingcaution

The project uses established build tooling including Turbo, Rollup, npm scripts, and TypeScript, but no security scanning tools were detected. This is a modest transparency and hygiene gap.

Workflow auditcaution

All four workflows were analyzed, with no untrusted checkout or script-injection trigger, but all six action references are unpinned. A high-confidence template-injection finding in dispatchWebsiteUpdate.yaml is also a workflow hygiene concern, while the absence of dangerous triggers limits its severity.