micromark-util-normalize-identifier

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which limits publication transparency. This is a moderate hygiene gap rather than evidence that the release is unsafe.

Maintainerscaution

Only one registry account has publish access. Organization backing makes a short registry maintainer list less concerning, but it still leaves publishing concentrated.

Release historycaution

The package has had no release for about 1 year and 10 months, with no releases in the last 12 months. The linked repository remains active, which partly offsets the stale registry cadence.

Repo bus factorcaution

All recent commits come from one contributor, creating maintenance concentration. The organization-owned repository provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

The repository recorded 11 commits in the last 3 months, showing ongoing work, but all were made by one active maintainer.