micromark-util-decode-string

Release historycaution

The package has made no release in the last 12 months, despite a release history dating back about five years; the linked repository remains active, partly compensating for the stale registry cadence.

Repo bus factorcaution

All 11 recent commits came from one contributor, concentrating maintenance responsibility and increasing continuity risk; organization backing provides some ability to hand work off.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-source relationship is less transparent than it should be, even though a monorepo mismatch can be ordinary.

Repo toolingcaution

The project uses established build tools, but no security scanning tools were detected; this is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed without audit findings and have no untrusted checkout or script-injection sinks. However, all seven action references are unpinned, weakening build reproducibility and supply-chain hygiene.