rehype

Release historycaution

The project has existed since June 2016 with 18 releases, but it has had no registry release in about two years. The long release gap is a maintenance caution, though the mature history partly compensates.

Repo commit activitycaution

There were no commits and no active maintainers in the measured three-month period, which weakens evidence of current maintenance capacity. The recent repository push and established project structure provide some compensation.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tool was detected. This is a modest transparency and hygiene gap, not a severe risk by itself.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings or untrusted checkouts, and the pull_request_target trigger has no reported sink. However, all four action references are unpinned, which weakens build reproducibility; the absence of top-level permissions blocks is acceptable here because no broad top-level write access was found.