remark-gfm

Build provenancecaution

No registry build attestation or trusted-publisher identity is present, reducing publication transparency, but this is a supply-chain transparency gap rather than evidence that the release is unsafe.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which warrants workflow review, but there are no untrusted checkouts or script-injection findings.

Release historycaution

Six releases over about six years with the latest released about 19 months before collection indicates a deliberately sparse cadence, but not abandonment by itself for a mature plugin.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with roughly 19 months since the latest push; this is the main abandonment concern.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security-scanning tools were detected, leaving a modest security-process gap.