hast-util-from-dom

Dangerous workflowscaution

One of two workflows uses pull_request_target, which warrants review because that workflow mode can expose elevated repository context, even though no untrusted checkout or script injection was detected.

Release historycaution

The package has existed since 2018 with 16 releases, but its latest release was on November 19, 2024 and it has had no releases in the last 12 months. That suggests slowing maintenance, though the long history provides some maturity evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the lack of recent releases, this is evidence of maintenance inactivity, although it is not yet evidence of abandonment by itself.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, supporting reproducible project maintenance, but no security scanning tools were detected.

Token permissionscaution

Neither workflow declares top-level token permissions, so the repository does not visibly limit workflow token access to read-only scope.