micromark-extension-gfm-table

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving release origin less transparent even though other package and repository evidence is healthy.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can require careful handling of untrusted changes, but no untrusted checkout or script-injection pattern was detected.

Repo commit activitycaution

The repository had no commits and no active maintainers in the last 3 months, which is a maintenance concern, but the same period includes a current release and recent issue or pull-request activity.

Repo toolingcaution

TypeScript and npm build tooling are used, but no repository security-scanning tools were detected; the documented build setup is present while automated security coverage is limited.

Token permissionscaution

Neither workflow declares top-level token permissions, and none declares top-level write access; the omission is less explicit than read-only permissions but does not show excessive access.