rehype-stringify

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving the origin of the published artifact less transparent.

Release historycaution

The package has existed for over 10 years with 18 releases, but has had no release in the last 12 months and its latest release was nearly two years ago, indicating slowed delivery.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful sign of currently limited development activity despite the repository being unarchived.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest repository-hygiene gap.

Workflow auditcaution

Both workflows were analyzed without high-confidence findings or untrusted checkouts, but all four action references are unpinned, weakening build reproducibility and update safety.