recma-build-jsx

Build provenancecaution

No registry build attestation or trusted-publisher identity is present, leaving publication provenance less transparent.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase CI risk if untrusted pull-request data reaches privileged actions; no untrusted checkout or script-injection pattern was detected.

Release historycaution

Only one release exists, published about 23 months ago, with no releases in the last 12 months; this limits evidence of ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, indicating currently inactive development; the recent-enough push and stable scope partly offset abandonment concern.

Repo issue activitycaution

There are no open issues or pull requests, and no recent issue or pull-request activity; this is neutral for a small stable package but provides little evidence of active maintenance.