hast-util-select

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This leaves publication origin less verifiable, though it does not by itself show that the release is unsafe.

Release historycaution

The package has existed since 2017 with 20 releases, but it has had no releases in about 19 months. That long pause lowers confidence in ongoing maintenance despite its established history.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with the extended release gap. This is the strongest maintenance concern for a dependency.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, showing a defined build process, but no security scanning tools were detected. The build setup is sound while security automation is limited.

Workflow auditcaution

Both workflows were analyzed successfully with no audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, which weakens automation reproducibility.