recma-jsx

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, so consumers have less evidence connecting the published artifact to its source build.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can create elevated workflow risk even though no untrusted checkout or script injection was detected.

Dependency profilecaution

The package has 5 runtime dependencies, including parser and transformation components, creating a meaningful dependency surface for consumers but not an unusually large one for this plugin.

Release historycaution

The package has only 2 releases over about 699 days, with no releases in the last 12 months and a median interval of about 283 days. This suggests a deliberately slow or inactive release cadence and lowers confidence in ongoing maintenance.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the recent release date but still indicating no current development activity.