hast-util-to-mdast

Dependency profilecaution

The package declares 14 runtime dependencies for an HTML-to-Markdown tree transformation. This is a substantial dependency surface but is consistent with the package's broad syntax-handling functionality.

Release historycaution

The project has 34 releases over roughly 9 years, but none in the last 12 months despite a latest release in January 2025. This indicates a meaningful maintenance slowdown, though the long release history shows established maturity.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Combined with no releases in the last 12 months, this is evidence of currently quiet maintenance.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of unsafe code.

Workflow auditcaution

Both workflows were analyzed successfully and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, leaving the build exposed to moving action revisions; the absence of top-level permissions blocks is not harmful on its own.