html-tags

Project backingcaution

The repository is maintained under a named individual account rather than an organization, so the single maintainer does not have organizational backing to offset the thin maintainer base.

Release historycaution

The package is mature, with 19 releases over more than 12 years, but it had no registry release in the last 12 months, which is a modest maintenance concern for a stable data package.

Repo toolingcaution

The repository uses npm build scripts, but no security scanning tools were detected; this is a minor transparency gap without other evidence of operational weakness.

Workflow auditcaution

Both workflows were analyzed without high-confidence findings, dangerous triggers, or untrusted checkouts, and one scopes permissions at job level. However, all five action references are unpinned, creating a workflow reproducibility and supply-chain hygiene gap.