@mdx-js/react

Release historycaution

The package has 119 releases over roughly seven years, but no releases in the last 12 months; the established history helps, while the recent pause lowers confidence in ongoing maintenance.

Repo bus factorcaution

One contributor made all commits in the last three months, concentrating current maintenance responsibility; organization backing provides some ability to hand off maintenance but does not remove the present concentration.

Repo commit activitycaution

Only two commits were recorded in the last three months, showing limited recent development activity despite the repository being recently pushed.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected, leaving a modest transparency gap.

Workflow auditcaution

All three workflows were analyzed with no detected sinks or audit findings, and no workflow has top-level write permissions. However, all 10 action references are unpinned, which weakens build reproducibility; the pull_request_target trigger is not dangerous on its own because no untrusted checkout or script injection was found.