markdown-it-anchor

Build provenancecaution

The release has no attestation, trusted publisher identity, or staged publishing. This weakens release transparency and reproducibility, though absence of provenance alone is not evidence of an unhealthy project.

Lifecycle scriptscaution

A prepare lifecycle script is present, adding install-time build behavior and therefore some supply-chain and reproducibility surface. No provided signal shows that this script is unsafe, so this is a limited caution rather than a severe risk.

Maintainerscaution

Two registry accounts have publish access. This is a modest publishing base, but registry access records do not establish active maintenance capacity, so it provides only limited reassurance.

Project backingcaution

The repository is owned by an individual GitHub user rather than an organization. That makes the single-contributor pattern more consequential because there is no observed organizational backing to compensate for concentrated maintenance.

Repo bus factorcaution

All two recent commits came from one contributor, producing a 100% top-contributor share and a low recent contributor count. Because the owner is an individual rather than an organization, this is a genuine resilience concern.