remark-breaks

Build provenancecaution

No registry build attestation or trusted publisher information is provided, leaving publication provenance less transparent, although this is not evidence that the package is unhealthy by itself.

Dangerous workflowscaution

One of two analyzed workflows uses pull_request_target, which can increase CI exposure when handling untrusted pull requests, though no untrusted checkout or script-injection pattern was detected.

Release historycaution

The package has existed since 2017 with 14 releases, but its latest release was about three years ago and it had no releases in the last 12 months. That is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the risk that maintenance has stalled.

Repo issue activitycaution

There are no open issues or pull requests and no recent issue or pull-request activity. This may reflect a mature small package, but it provides no evidence of active maintenance.