rehype-harden

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing publication transparency, although this is a provenance gap rather than evidence of a bad release.

Maintainerscaution

Only one registry account has publish access. The repository is organization-owned, which provides some backing, but the registry publishing base remains concentrated.

Repo commit activitycaution

Zero commits and zero active maintainers were recorded over the last three months, weakening confidence in ongoing maintenance even though the repository has a recent push timestamp.

Repo package mentioncaution

The repository name does not match rehype-harden and its README does not mention the package, so the link does not clearly establish package ownership; organization backing only partly offsets this uncertainty.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear for a security-focused package.