recharts

Lifecycle scriptscaution

The package runs a prepare install-time lifecycle script. This is a meaningful supply-chain and installation-complexity consideration, though the other evidence shows a mature published project.

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability-reporting and response expectations less explicit for users and maintainers.

Workflow auditcaution

All 64 analyzed action references are unpinned, and a pull_request_target workflow performs an untrusted checkout; high-confidence template-injection findings and a bot-condition finding add workflow hygiene risk, although the sinks and triggers are not all shown in the same workflow.