posthtml

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how the artifact was produced. This is a supply-chain transparency gap, not evidence of maliciousness.

Lifecycle scriptscaution

A prepare install-time script is present, adding execution during installation. This is a manageable packaging concern rather than a health verdict, especially given the repository and release evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. That is a real current-maintenance concern, although it is partly offset by the recent release and the project's long history.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with 15 open issues and 3 open pull requests. This indicates limited recent project interaction, but not enough alone to establish abandonment.

Repo toolingcaution

The repository uses build tooling, showing an established development process, but it has no security scanning tools. The missing scanning is a modest transparency and maintenance gap.