mdast-util-directive

Build provenancecaution

No registry build attestation or trusted-publisher provenance is present, leaving publication origin less transparent, but this is a moderate transparency gap rather than a severe risk.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months, a maintenance concern; the current release and repository push provide some compensating evidence.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tool was detected, leaving a modest assurance gap.

Workflow auditcaution

Both workflows were analyzed without failed files or audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, weakening workflow reproducibility and supply-chain protection.