micromark-util-symbol

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can require careful handling of untrusted pull requests, although no untrusted checkout or script-injection pattern was detected.

Release historycaution

The package has nine releases since June 2021, but its latest release was in November 2024 with no releases in the last 12 months. Active repository commits partly compensate for the slower release cadence, but the release gap remains a maintenance caveat.

Repo bus factorcaution

All 11 recent commits came from one contributor, leaving maintenance dependent on a single active individual. Organization backing reduces the organizational risk but does not remove the contributor-concentration concern.

Repo toolingcaution

The project uses TypeScript, Rollup, esbuild, and npm scripts, showing a structured build process, but no security-scanning tools were detected.

Token permissionscaution

Neither analyzed workflow declares top-level token permissions, so the repository provides limited evidence of explicitly minimized workflow privileges.