micromark-util-decode-numeric-character-reference

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent.

Release historycaution

The package has six releases over roughly five years, but no release in the last 12 months; this lowers confidence in ongoing release maintenance.

Repo bus factorcaution

All 11 recent commits came from one contributor, creating a meaningful continuity risk, although organization ownership provides some capacity to hand off maintenance.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so package ownership is less transparent; the monorepo structure provides some context but does not remove the gap.

Repo toolingcaution

The project uses TypeScript, Rollup, esbuild, and npm scripts, but no security-scanning tools were detected; the missing scanning is a modest hygiene gap.