micromark-extension-gfm-task-list-item

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, but not severe enough to outweigh the repository and release evidence.

Release historycaution

The package has had 15 releases since September 2020, but its latest registry release was over two years ago and there were no releases in the last 12 months. This indicates a meaningful maintenance slowdown for a dependency.

Repo commit activitycaution

There were no commits and no active maintainers in the three months before collection, consistent with the release-history slowdown. This raises abandonment risk, although the repository is not archived.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, providing a defined build process. No security scanning tools were detected, which is a minor transparency gap.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings, no untrusted checkout, and no script injection. However, all four action references are unpinned, which is a supply-chain hygiene weakness; the pull_request_target trigger has no dangerous sink here.