hast-util-to-parse5

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between the published artifact and its source less transparent.

Release historycaution

The package has been maintained since 2016 with 16 releases, but only one release in the last 12 months and a median interval of about 159 days indicate a modest cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, a meaningful sign of currently limited maintenance activity.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest hygiene gap.

Workflow auditcaution

Both workflows were analyzed without high-confidence findings or untrusted checkouts, but all four action references are unpinned; the pull_request_target trigger has no detected sink.