react-markdown

It has strong consumer documentation, bundled TypeScript declarations, release notes, and clear organization backing. Licensing, repository identity, and non-install-time behavior are solid; the main reservation is reduced recent maintenance activity.

Latest 10.1.0

NPM

70%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is present. This is a transparency limitation, though it does not by itself indicate abandonment.

Dangerous workflows

One of two workflows uses pull_request_target, which can require careful handling of untrusted changes, but no untrusted checkout or script injection was detected. The net workflow risk is limited.

Release history

The package has 99 releases over more than 11 years, but no registry releases in the last 12 months and its latest release was over a year ago. This lowers confidence in current maintenance.

Repo bus factor

One contributor made all three commits in the last three months, concentrating recent work completely in one person. Organization backing partly compensates for this concentration, but it remains a maintenance concern.

Repo commit activity

Only three commits were recorded in the last three months, all from one active maintainer. This is modest recent activity and lowers the maintenance outlook.