recma-stringify

Build provenancecaution

No registry build attestation, trusted publisher, or staged publishing is present, reducing transparency about how the artifact was produced.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which warrants caution because that trigger can run with elevated repository context, although no untrusted checkout or script injection was detected.

Maintainerscaution

A single registry publishing account is listed, which is a modest operational risk, though the organization-owned repository provides compensating project backing.

Release historycaution

This is the package's only release, published nearly two years ago, with no releases in the last 12 months. That may reflect a stable package, but it leaves limited evidence of ongoing release maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent repository push provides some compensating evidence, but current development activity is still unclear.