mdast-util-definitions

Build provenancecaution

No build attestation or trusted-publisher identity is reported, so the release has limited provenance evidence. This is a supply-chain transparency gap, but not a standalone health verdict.

Release historycaution

The package has existed for about 11 years with 20 releases, but it has had no release in about 3 years. That long release gap lowers confidence in ongoing maintenance, although the package may be stable.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, alongside a last push in July 2023. This is strong evidence of stalled maintenance, partly offset by the package's mature, small scope.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of abandonment.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings or untrusted checkouts, and the pull_request_target trigger has no detected sink. However, all 4 action references are unpinned, which weakens build reproducibility.