parse5-htmlparser2-tree-adapter

Build provenancecaution

No build provenance attestation or trusted-publisher identity is present, so consumers have less verifiable evidence connecting the published artifact to the source build.

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot automation, which warrants review because that trigger can grant elevated workflow context; no untrusted checkout or script-injection patterns were detected.

Repo bus factorcaution

One contributor made 100% of the six recent commits, creating a meaningful single-person continuity risk for ongoing maintenance.

Repo commit activitycaution

Six commits were made in the last three months, but all came from one active maintainer, leaving limited recent contributor redundancy.

Repo package mentioncaution

The linked repository is a parse5 monorepo, but it neither matches the package name nor mentions this package in its README. The repository file tree does contain a dedicated package directory, which partly compensates but does not remove the transparency concern.