micromark-factory-label

Release historycaution

The package has 10 releases since 2021, but none in the last 12 months and the latest release was about 22 months ago. This indicates meaningful release staleness despite a previously regular cadence.

Repo bus factorcaution

All 11 recent commits came from one contributor, creating concentration risk. However, the repository is owned by an organization, which provides some capacity to hand maintenance off.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention it, so the package-to-repository relationship is not transparent even though the repository is a related monorepo-style project.

Repo toolingcaution

The project uses TypeScript, Rollup, esbuild, and npm scripts, indicating an established build process. No security-scanning tool was detected, which is a minor hygiene gap.

Workflow auditcaution

Both workflows were analyzed without failures, and the pull_request_target trigger has no untrusted checkout or script-injection sink. However, all seven action references are unpinned, leaving a supply-chain hygiene gap.