micromark-extension-gfm

Lifecycle scriptscaution

A prepack lifecycle script adds build-time complexity and a publishing step to inspect, but it is not by itself evidence of unsafe runtime installation behavior.

Release historycaution

The package has 12 releases over about six years, but none in the last three years, which raises maintenance and abandonment concerns for a library dependency.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, reinforcing the concern raised by the long gap since the latest registry release.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected; this is a modest transparency and hygiene gap rather than a severe risk.

Workflow auditcaution

Both workflows were analyzed without reported audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, weakening build reproducibility and supply-chain hygiene.