micromark-extension-gfm-footnote

Lifecycle scriptscaution

A prepack lifecycle script runs during packaging. This is a build-time script rather than an install-time dependency action, so it is a modest transparency consideration, not a severe concern.

Release historycaution

The package has 10 releases since October 2021, but its latest release was over two years ago and there were no releases in the last 12 months. This indicates materially slowed maintenance for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old latest release, this is the main abandonment concern.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, showing a structured build process, but no security-scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of unfitness.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, which weakens reproducibility and supply-chain hygiene.