hast-util-minify-whitespace

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can require careful handling of untrusted contributions and adds some workflow-risk exposure. No untrusted checkout or script-injection pattern was detected to amplify that concern.

Release historycaution

Only two releases were published, with the latest release nearly two years ago and no releases in the last 12 months. This limits evidence of ongoing release maintenance, although the short nine-day interval between the initial releases shows a stable 1.0 line rather than an abandoned pre-release.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern for a package whose registry releases have also stopped.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the link may represent a broader project repository rather than clearly documenting this package.

Token permissionscaution

Neither analyzed workflow declares top-level token permissions, so the repository does not clearly demonstrate least-privilege defaults. No workflow was observed requesting top-level write permissions.