@parcel/core

The project has strong release history, clear licensing, bundled types, tests, and organizational backing. Maintenance has paused for three months, while release workflows use unpinned actions and contain high-confidence template-injection findings. Pin this version only with workflow risk understood.

Latest 2.16.4

NPM

68%

Total Score

Maintainer Stability

Dependencies

Maturity

100

Supply Chain

Attestations

Health Score Breakdown

Workflow audit

All 49 analyzed action references are unpinned, and the release workflow has three high-confidence template-injection findings; reusable workflows also inherit secrets. The audit was complete, while the low-confidence cache findings are only hygiene concerns.

Build provenance

No build attestation or trusted-publisher identity is present, leaving release provenance less transparent despite the package's broader project maturity.

Dependency profile

The package has 25 runtime dependencies, including many internal Parcel modules. This is a meaningful dependency surface, but it is consistent with a mature build-system core rather than an unexplained minimal package.

Repo commit activity

The repository recorded zero commits and zero active maintainers over the last three months, a material maintenance warning despite a recent push and continued registry releases.

Repo issue activity

Issues and pull requests remain active, with three new and three closed issues and eight new pull requests in the last month. No pull requests were merged in that period, so this is supportive but not fully reassuring.