micromark-extension-mdxjs-esm

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less independently verifiable.

Release historycaution

The package has 14 releases since November 2020, but none in the last 12 months and its latest registry release was in October 2023, which raises staleness concerns.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating currently quiet maintenance.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest hygiene gap.

Workflow auditcaution

Both workflows were analyzed without audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four action references are unpinned, which weakens build reproducibility.