hast-util-phrasing

Lifecycle scriptscaution

A prepack lifecycle script is present, adding a build-time supply-chain surface. No evidence here shows that it executes during a consumer's install.

Release historycaution

The package has 11 releases since September 2016, but no release in more than 3 years and no releases in the last 12 months. Its long history provides some maturity, but the prolonged release gap lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the release gap. This raises abandonment risk despite the repository remaining unarchived.

Repo toolingcaution

The project uses TypeScript and npm scripts for builds, but no security scanning tools were detected. The build setup is established, while the missing scanning is a modest transparency gap.

Workflow auditcaution

Both workflows were analyzed without failed files or audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, leaving a modest dependency-integrity concern.