micromark-util-resolve-all

Release historycaution

The package has eight releases since June 2021, but no registry release in the last 12 months. The active repository partly compensates for the slow package cadence because this is a mature utility.

Repo bus factorcaution

All 11 recent commits came from one contributor, creating a genuine continuity risk. Organization backing provides some mitigation, but no second active contributor is shown.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the package-to-repository relationship is not clearly demonstrated. The monorepo structure makes a name mismatch ordinary, but the missing README mention remains a caution.

Repo toolingcaution

The project uses established build tools, but no security scanning tools were detected; this is a modest transparency gap rather than a severe dependency risk.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all seven action references are unpinned, which weakens build reproducibility.