✓ Safe to use
Deep-scanned by ShadowCanopy — no threats found in its code, dependencies, or network behavior.
Scanned 9/20/2026 Official React DOM package with no static findings or sandbox anomalies. All files match expected legitimate distribution.
AI breakdown Plain-English summary of what this package does and how it behaves.
Official React package for rendering components to the DOM in browser and server environments.
Capabilities
Renders React components to DOM Provides server-side rendering Includes test utilities Supports profiling builds Network
No network access observed Core React library with no static findings or unusual scripts; standard dependency on scheduler and loose-envify.
Dependency & execution chain Every package this one pulls in, colored by verdict. Expand to walk the tree.
License MIT
React package for working with the DOM.
LICENSE package/LICENSE client.js package/client.js index.js package/index.js profiling.js package/profiling.js cjs/react-dom-server-legacy.browser.development.js package/cjs/react-dom-server-legacy.browser.development.js umd/react-dom-server-legacy.browser.development.js package/umd/react-dom-server-legacy.browser.development.js cjs/react-dom-server-legacy.browser.production.min.js package/cjs/react-dom-server-legacy.browser.production.min.js umd/react-dom-server-legacy.browser.production.min.js package/umd/react-dom-server-legacy.browser.production.min.js cjs/react-dom-server-legacy.node.development.js package/cjs/react-dom-server-legacy.node.development.js cjs/react-dom-server-legacy.node.production.min.js package/cjs/react-dom-server-legacy.node.production.min.js cjs/react-dom-server.browser.development.js package/cjs/react-dom-server.browser.development.js umd/react-dom-server.browser.development.js package/umd/react-dom-server.browser.development.js cjs/react-dom-server.browser.production.min.js package/cjs/react-dom-server.browser.production.min.js umd/react-dom-server.browser.production.min.js package/umd/react-dom-server.browser.production.min.js cjs/react-dom-server.node.development.js package/cjs/react-dom-server.node.development.js cjs/react-dom-server.node.production.min.js package/cjs/react-dom-server.node.production.min.js cjs/react-dom-test-utils.development.js package/cjs/react-dom-test-utils.development.js umd/react-dom-test-utils.development.js package/umd/react-dom-test-utils.development.js cjs/react-dom-test-utils.production.min.js package/cjs/react-dom-test-utils.production.min.js umd/react-dom-test-utils.production.min.js package/umd/react-dom-test-utils.production.min.js
Show all 60 files How ShadowCanopy checks npm packages ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.