@uiw/codemirror-extensions-basic-setup

Repo commit activitycaution

The repository recorded two commits in the last 3 months, so activity is present but relatively light for a project releasing this package frequently.

Repo package mentioncaution

The linked repository name does not match this package and its README does not mention the package, so the package-to-source relationship is not clearly established despite the repository containing a matching extension directory.

Repo toolingcaution

The project uses TypeScript, npm scripts, and ncc, but no security scanning tooling was detected; this is a modest transparency gap rather than a severe concern.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers, untrusted checkouts, script injection, or audit findings, and one scopes permissions at job level. However, all 11 action references are unpinned, which weakens build reproducibility and supply-chain control.