markdown-it-anchor

markdown-it-anchor 10.0.0 appears healthy and reasonable to depend on: it has a long release history, a current stable release, no registry deprecation, an active non-archived repository, a matching repository with clear package references, and minimal runtime dependencies. The main concerns are limited recent contributor capacity, with only two commits from one contributor in the last three months, no security scanning or security policy, and no build provenance attestation. These reduce transparency and resilience somewhat, but the repository contains tests and a changelog even though they are not packaged, and the package has an established artifact structure, license, and type declarations.

Latest 10.0.0

NPM

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Health Score Breakdown

Build provenance

The release has no attestation, trusted publisher identity, or staged publishing. This weakens release transparency and reproducibility, though absence of provenance alone is not evidence of an unhealthy project.

Lifecycle scripts

A prepare lifecycle script is present, adding install-time build behavior and therefore some supply-chain and reproducibility surface. No provided signal shows that this script is unsafe, so this is a limited caution rather than a severe risk.

Maintainers

Two registry accounts have publish access. This is a modest publishing base, but registry access records do not establish active maintenance capacity, so it provides only limited reassurance.

Project backing

The repository is owned by an individual GitHub user rather than an organization. That makes the single-contributor pattern more consequential because there is no observed organizational backing to compensate for concentrated maintenance.

Repo bus factor

All two recent commits came from one contributor, producing a 100% top-contributor share and a low recent contributor count. Because the owner is an individual rather than an organization, this is a genuine resilience concern.