remark-frontmatter

Build provenancecaution

No build attestation or staged publishing is present, so consumers have less evidence connecting the registry artifact to its source. The stable repository and release history partly compensate, but provenance remains limited.

Release historycaution

The package has 13 releases over more than nine years, but its latest release was in September 2023 and there were no releases in the following 12 months. This indicates a mature but currently inactive release stream.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The package may be stable, but current maintenance capacity is not demonstrated.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe risk.

Workflow auditcaution

Both workflows were analyzed with no failed files or audit findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all four referenced actions are unpinned, which is a supply-chain hygiene gap.