rehype-highlight

Build provenancecaution

No build attestation or trusted-publisher provenance was provided, leaving publication origin less transparent, though this is not by itself evidence of an unhealthy project.

Release historycaution

The package has 20 releases over more than 10 years, but none in the last 12 months and its latest release was about 19 months ago, indicating slowed maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the measured three-month period, which supports the concern that maintenance has slowed.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security-scanning tool was detected, leaving a modest hygiene gap.

Workflow auditcaution

Both workflows were analyzed without findings or untrusted checkouts, and neither grants top-level write access; however, all four action references are unpinned, which weakens build reproducibility.