estree-util-value-to-estree

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a single project owner; other release and repository evidence partly offsets this risk.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, despite a push in April 2026; this indicates a recent maintenance slowdown rather than clear abandonment.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tool was detected; this is a minor transparency gap rather than a severe concern.

Workflow auditcaution

The workflow audit completed fully and found no untrusted checkout or script-injection path, with job-level permissions used. However, all 14 action references are unpinned, and the reported cache-poisoning findings are low-confidence hygiene concerns.