rehype-parse

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, leaving the connection between source and published artifact less transparent. This is a supply-chain hygiene gap, not evidence that the release is unsafe.

Release historycaution

The package has a long history and 22 releases, but its latest registry release was about two years ago and there were no releases in the last 12 months. This suggests slowing maintenance rather than immediate abandonment.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the past three months. This is a meaningful maintenance concern, although the repository is not archived and was pushed recently.

Repo toolingcaution

The project uses TypeScript and npm build tooling, which supports reproducible project maintenance, but no security-scanning tools were detected. That is a modest transparency and maintenance gap.

Workflow auditcaution

Both workflows were analyzed successfully and no dangerous findings were reported, but all four referenced actions are unpinned. The repository also uses a pull_request_target trigger without an observed untrusted checkout or script-injection sink.