hast-util-is-element

Build provenancecaution

No build attestation or trusted-publisher provenance is available. This limits publication transparency, but it is not by itself evidence that the package is unsafe to depend on.

Release historycaution

The package has 13 releases over roughly 10 years, but the latest release was about 3 years ago and there were no releases in the last 12 months. This indicates meaningful staleness despite its established history.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months, consistent with the repository having been inactive for about 3 years. This raises maintenance and abandonment risk.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tool was detected. The repository's security policy provides some compensating transparency.

Workflow auditcaution

Both workflows were analyzed successfully with no concrete audit findings or dangerous untrusted checkouts. However, all four action references are unpinned, which weakens build reproducibility and supply-chain hygiene.