mdast-util-to-markdown

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving publication origin less independently verifiable despite the package's otherwise healthy maintenance evidence.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no repository security-scanning tool was detected. This is a modest transparency and hygiene gap, not evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed without failed files or dangerous findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, which weakens reproducibility and supply-chain hygiene.