rehype-autolink-headings

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, but it is partly offset by the linked, matching repository and clear package contents.

Release historycaution

The package has 16 releases over nearly 10 years, but its latest release was nearly three years ago and there were no releases in the last 12 months. This suggests slowing maintenance, though the stable release history is otherwise mature.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. Combined with the old latest release, this is the clearest maintenance concern, although the repository was pushed in September 2024.

Repo toolingcaution

The project uses TypeScript and npm build tooling, which supports a structured build. No security-scanning tooling is reported, leaving a modest hygiene gap.

Workflow auditcaution

Both workflows were analyzed successfully with no audit findings, and the pull_request_target trigger has no untrusted checkout or script-injection sink. However, all four action references are unpinned, weakening build reproducibility.