markdown-extensions

Build provenancecaution

No build attestation or trusted-publishing provenance is present, so consumers cannot verify how the registry artifact was produced. This is a transparency gap, but the package is a small artifact with no runtime dependencies.

Release historycaution

The package has existed since 2015 but has only four releases, with no release in the last 12 months and the latest release in August 2023. That long interval lowers confidence in ongoing release maintenance, although this small data package may require few changes.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This suggests limited current development activity, though the package may be intentionally stable.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both referenced actions are unpinned, leaving avoidable build reproducibility and action-update risk.