hast-util-to-jsx-runtime

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded. This reduces publication transparency, though the package has a matching source repository, license, and documented build tooling.

Release historycaution

The package has 15 releases over about three years with a typical interval of 12 days, but it has had no release in the last 12 months. This is a meaningful maintenance concern despite the previously regular cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is the strongest abandonment concern, although the package may be stable and the repository is not archived.

Repo toolingcaution

The project uses TypeScript, esbuild, and npm scripts, showing an established build process, but no security-scanning tools were detected. The tooling is otherwise appropriate for the package.

Workflow auditcaution

Both workflows were fully analyzed with no detected findings or untrusted checkouts, and no workflow has top-level write permissions. However, all four action references are unpinned, leaving avoidable build-reproducibility and action-update risk.