hast-util-to-string

Repo package mentiondanger

The linked repository name does not match hast-util-to-string and its README does not mention the package, so the repository may not be the package's actual source; this materially reduces transparency.

Release historycaution

The package has existed since 2016 with eight releases, but it has had no release in the last 12 months and its median release interval is about 394 days, indicating a slow cadence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which is a meaningful sign of currently quiet maintenance.

Repo toolingcaution

The project uses TypeScript and npm scripts, showing an established build setup, but no security scanning tools were detected.

Workflow auditcaution

Both workflows were analyzed without audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, which weakens workflow reproducibility.