rehype-raw

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving publication provenance less transparent even though this is not evidence of malicious behavior.

Release historycaution

The package has 12 releases since 2016, but none in the last 12 months and its latest release was in August 2023, nearly three years ago. This is a meaningful maintenance concern for a library dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the old latest release, this points to reduced current maintenance capacity.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected. This is a modest hygiene gap rather than a severe dependency risk.

Workflow auditcaution

Both workflows were analyzed successfully with no audit findings and no broad top-level write permissions. However, all four action references are unpinned, which weakens reproducibility and supply-chain hygiene.