micromark-factory-space

micromark factory to parse markdown space (found in lots of places)

Latest 2.1.0

76%

Total Score

healthy

Healthy release with active maintenance and strong package hygiene, tempered by single-contributor activity and unpinned workflow actions.

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance was reported, leaving publication origin less independently verifiable.

Repo bus factor

All 11 recent commits came from one contributor. Organization ownership provides some ability to hand off maintenance, but no second active contributor is shown, leaving a real continuity risk.

Repo package mention

The repository name does not match the package and its README does not mention this package, so package-to-repository ownership is less transparent. The package does appear in the repository's monorepo tree, which partially compensates for the README gap.

Repo tooling

The project uses TypeScript, Rollup, esbuild, and npm scripts, indicating a structured build. No security-scanning tooling was detected, which is a modest transparency gap.

Workflow audit

Both workflows were analyzed without failures, and the pull_request_target workflow has no untrusted checkout or script-injection findings. However, all seven action references are unpinned, which weakens build reproducibility and action supply-chain protection.