markdown-to-jsx

Dangerous workflowscaution

One Dependabot workflow uses pull_request_target with an untrusted checkout, creating a workflow-risk concern. No script-injection workflows were detected, which limits the severity.

Lifecycle scriptscaution

A prepublish lifecycle script is present. It is not shown to be malicious, but lifecycle scripts add build-time or publish-time behavior that deserves review compared with a package requiring no scripts.

Project backingcaution

The repository is owned by an individual user rather than an organization. Combined with concentrated recent commits, this provides less visible maintenance redundancy than an organization-backed project.

Repo bus factorcaution

One contributor made about 91% of the 23 recent commits, leaving a concentrated maintenance base despite three active contributors. This raises continuity risk if the lead maintainer becomes unavailable.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is partly offset by the repository's active security scanning.