mdast-util-to-hast

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the connection between source and published artifact less transparent.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can require careful handling of untrusted pull requests; no untrusted checkout or script-injection pattern was detected to compound the concern.

Release historycaution

The package has existed for about 10 years with 60 releases and a recent release, although only one release occurred in the last 12 months, indicating slower current cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a concrete sign of currently quiet maintenance despite the recent release.

Repo toolingcaution

TypeScript and npm build tooling are used, but no security scanning tools are reported, leaving a modest security-process gap.