hast-util-sanitize

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable than it could be. This is a transparency gap but not evidence of a bad release.

Release historycaution

The package has 20 releases over more than 10 years, but no releases in the last 12 months and its latest release was nearly two years ago. This points to reduced maintenance activity, though the long release history shows maturity.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, reinforcing the sign that maintenance has slowed substantially.

Repo toolingcaution

The repository uses TypeScript and npm scripts, but no security-scanning tools were detected. The missing scanning is a modest hygiene gap, partly offset by the separate security policy.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings or untrusted checkouts, but all 4 action references are unpinned. One pull_request_target trigger is ordinary and has no reported dangerous sink.