mdast-util-find-and-replace

Repo bus factorcaution

All two recent commits came from one contributor, so maintenance is concentrated and continuity depends heavily on that person.

Repo toolingcaution

The repository uses TypeScript and npm scripts, but no security-scanning tool was detected. The missing scanner is a hygiene gap rather than evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous sinks or audit findings, and no workflow grants top-level write access. However, all four action references are unpinned, leaving avoidable update-integrity risk.