markdownlint-cli

Build provenancecaution

No build attestation or trusted-publisher provenance is provided, leaving publication origin less independently verifiable despite the package's established release history.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated recent commit activity has less visible institutional redundancy.

Repo bus factorcaution

Two contributors were active recently, but one made 8 of 9 commits, so maintenance is substantially concentrated in a single contributor.

Security policycaution

The repository has no published security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

Both workflows were fully analyzed with no reported audit findings and no untrusted checkouts or script injection. However, all 8 action references are unpinned, which weakens build reproducibility and action supply-chain control.