mdast-util-gfm-footnote

Build provenancecaution

No build attestation or trusted-publishing provenance was provided, leaving release origin less independently verifiable.

Release historycaution

The latest release was about 19 months ago, with no releases in the last 12 months; this lowers confidence in ongoing maintenance despite five releases overall.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, reinforcing the concern raised by the long gap since the latest registry release.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected; this is a modest transparency and hygiene gap.

Workflow auditcaution

Both workflows were fully analyzed with no detected audit findings or untrusted checkouts, but all four referenced actions are unpinned, leaving avoidable dependency-integrity risk.