@mdx-js/loader

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication authenticity less transparent than it could be.

Release historycaution

The project has 218 releases over roughly eight years, but it published no releases in the last 12 months despite a historically frequent cadence. This is a meaningful maintenance slowdown.

Repo commit activitycaution

Three commits from two active maintainers in the last three months show ongoing repository activity, but the volume is modest for a mature project.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so package ownership is less explicit. The package README and shared organization reduce, but do not remove, that concern for this monorepo-style package.

Repo toolingcaution

The repository uses established build tools, but no security-scanning tools were detected, leaving a modest security-process gap.