markdown-it

Build provenancecaution

No build attestation or trusted-publisher identity is reported, leaving publication provenance less independently verifiable. The active repository and regular release history provide maintenance evidence but do not replace provenance metadata.

Lifecycle scriptscaution

A prepack script is present, so packaging involves an install-adjacent build step. Because it is limited to prepack rather than an install or postinstall script, the supply-chain exposure is relatively limited but still warrants awareness.

Maintainerscaution

Only one registry account has publish access, which creates registry publishing concentration. However, the repository is organization-owned and shows four active contributors, so this is a publishing-hygiene concern rather than evidence of project abandonment.

Repo bus factorcaution

One contributor made about 92.4% of the 66 recent commits, creating concentrated maintenance knowledge. The other three contributors remain active and organization backing provides some handoff capacity, so this is a caution rather than a severe risk.

Repo toolingcaution

The repository uses TypeScript, npm scripts, Rolldown, and Vite for builds, demonstrating structured build tooling. No security-scanning tools are reported, leaving a security-hygiene gap despite the otherwise mature tooling.