html5parser

Lifecycle scriptscaution

A prepare script runs during installation or packaging, adding some execution surface, but this signal alone does not show that it is unsafe or unusually complex.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign of slowing maintenance for a package consumers may depend on.

Repo toolingcaution

The project uses TypeScript, Vitest, and a build tool, supporting repeatable development, but no security scanning tools were detected.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

The audit covered both workflows and found no injection or high-severity findings, but all four action references are unpinned and one workflow has top-level write permissions, creating avoidable workflow-hygiene risk.