eslint-plugin-jsx-a11y

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, reducing publication transparency. This is partly offset by the repository's established tooling and security scanning, but the artifact's origin is still less independently verifiable.

Release historycaution

The package has a substantial history with 85 releases since 2016, but it has had no registry release in the last 12 months and its latest release was nearly two years ago, indicating slowed maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign of currently limited maintenance despite the project's long history.

Workflow auditcaution

All 18 analyzed action references are unpinned, which weakens build reproducibility. The audit found no untrusted checkouts, script injection, high-severity findings, or top-level write permissions, so this remains a hygiene concern rather than a severe risk.