hast-util-to-estree

Build provenancecaution

No build provenance attestation or trusted-publisher setup was detected, so consumers cannot verify how the published artifact was produced. This is a transparency gap, not evidence that the package is unsafe.

Release historycaution

The package has 27 releases over about 5 years, but it has had no release in the last 12 months and the latest release was about 18 months ago, which raises maintenance concern.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months; together with no release in about 18 months, this is the clearest maintenance warning.

Repo toolingcaution

The repository uses TypeScript and npm scripts, showing a defined build process, but no security-scanning tool was detected, leaving a minor tooling gap.

Workflow auditcaution

Both workflows were analyzed with no audit findings, no untrusted checkout or script-injection sinks, and no broad top-level write permissions. However, all 4 action references are unpinned, which is a workflow supply-chain hygiene weakness.