@nuxtjs/mdc

Package scaffoldingdanger

The package includes a substantial README and release notes, but the README explicitly says MDC is being deprecated in favor of Comark. That planned replacement materially increases migration and long-term maintenance risk.

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This weakens publication transparency, but the active repository and matching package structure provide partial compensating evidence.

Repo bus factorcaution

One contributor made 8 of the 9 recent commits, leaving a thin practical bus factor. Organization backing provides some handoff capacity, but the observed activity is still concentrated.

Security policycaution

The repository has no security policy. This is a transparency gap for a package that processes Markdown and integrates with application components, although it is not evidence of abandonment by itself.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkout or script-injection findings, but both action references are unpinned and it has a high-confidence adhoc-packages finding for installing outside a lockfile.