estree-util-attach-comments

Release historycaution

The package has six releases since December 2020, but none in the last 12 months and its latest release was about 3 years ago. This indicates a mature but currently inactive release cadence.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last 3 months, consistent with the roughly 3-year gap since the last push. This is the strongest maintenance concern for a dependency.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, showing a defined build process, but no security scanning tools were detected. The missing scanning is a modest hygiene gap rather than evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed with no audit findings or untrusted checkouts, and neither grants top-level write permissions. However, all 4 analyzed action references are unpinned, leaving avoidable build reproducibility and action-update risk.