micromark-util-character

Build provenancecaution

No build provenance attestation or trusted-publisher identity was reported, so the release's publication path is less independently verifiable despite the established repository and build tooling.

Release historycaution

The package has had no registry release in the last 12 months, and its latest release was in November 2024. However, the linked repository still shows recent activity, reducing abandonment concern.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so package ownership is less transparent. The repository is clearly structured as a multi-package project, which partly explains the mismatch.

Repo toolingcaution

The project uses TypeScript, Rollup, esbuild, and npm scripts, showing an established build process. No security scanning tools were detected, leaving a modest transparency gap.

Workflow auditcaution

Both workflows were analyzed without high- or medium-severity findings, and the pull_request_target workflow has no detected untrusted checkout or script-injection sink. All seven action references are unpinned, which is a minor reproducibility and supply-chain hygiene concern.