estree-util-build-jsx

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable than it could be. This is a transparency gap, not evidence that the release is unsafe.

Release historycaution

The package has had no registry release in nearly three years, and there were no releases in the last 12 months. Its nine releases since 2020 show a real project history, but the current pause raises maintenance risk.

Repo commit activitycaution

There were no commits or active maintainers in the last three months. Combined with the old latest release, this indicates currently quiet maintenance, though the repository was pushed in August 2024.

Repo toolingcaution

The repository uses TypeScript, esbuild, and npm scripts, showing an established build process. No security-scanning tooling was detected, leaving a modest hygiene gap.

Workflow auditcaution

Both workflows were analyzed without audit findings or untrusted checkouts, and the pull_request_target trigger has no identified sink. However, all four action references are unpinned, reducing build reproducibility and supply-chain hygiene.