remark-math

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase CI exposure when handling untrusted contributions; no untrusted checkout or script injection was detected to compound the risk.

Release historycaution

The package has 24 releases since 2017, but its latest release was about three years ago and there were no releases in the last 12 months, indicating stalled release activity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern even though it was pushed in February 2025.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest transparency gap.

Token permissionscaution

Both analyzed workflows lack top-level token permissions declarations, so their default permissions are less explicit than preferred.