rehype-slug

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing publication transparency for a package that uses a prepack build step.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase workflow risk when handling untrusted pull requests, although no untrusted checkout or script-injection pattern was detected.

Release historycaution

The package has existed since 2016 with 12 releases, but its latest release was about three years ago and there were no releases in the last 12 months, indicating possible stagnation.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, reinforcing the substantial maintenance gap indicated by the release history.

Repo issue activitycaution

There are no open issues or pull requests, which is consistent with a small stable package but also provides no evidence of recent project response activity.