hast utility that turns HTML into a syntax tree (while being small in browsers)
64%
Total Score
75
88
83
The package has only two releases, with no releases in the past three years and the latest published in August 2023. The exact release has notes, but the long pause limits evidence of ongoing maintenance.
The repository recorded zero commits and zero active maintainers in the past three months, consistent with the long release gap and reducing confidence in active maintenance.
The project uses TypeScript and npm build tooling, but no repository security scanning tools were detected. This is a modest transparency gap rather than evidence of abandonment.
Both workflows were analyzed successfully with no audit findings and no top-level write permissions. However, all four referenced actions are unpinned, leaving avoidable build-reproducibility and action-substitution risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@types/hast Version ^3.0.0 | — | — |
hast-util-from-dom Version ^5.0.0 | — | — |
hast-util-from-html Version ^2.0.0 | — | — |
unist-util-remove-position Version ^5.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.