rehype-remark

Build provenancecaution

No build attestation or trusted-publisher provenance was detected. This limits publication transparency, though it is a supply-chain hygiene gap rather than a direct maintenance failure.

Release historycaution

The package has existed for about 9.6 years with 21 releases, but it has had no release in the last 12 months; the latest release was about 17 months ago. This indicates slowing maintenance despite a mature history.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Combined with no registry release in the last 12 months, this is meaningful evidence of currently limited maintenance.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected. The missing scanning is a modest transparency gap, not evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed with no reported audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all 4 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.