js-md4

Release historydanger

The package has had no release in more than 9 years, with zero releases in the last 12 months; this is strong evidence of stale maintenance for a dependency.

Repo commit activitydanger

The repository had zero commits and zero active maintainers in the last 3 months, reinforcing the evidence of inactive ongoing maintenance.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing release transparency, though this is a secondary concern for the otherwise simple package.

Maintainerscaution

Only one registry publishing account is listed, leaving limited publishing redundancy; this is partly consistent with the repository being owned by an individual rather than an organization.

Repo toolingcaution

The project uses npm scripts for builds but reports no security-scanning tools, leaving security checks less visible.