remark-rehype

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less evidence about how the artifact was produced. This is a transparency gap, but it is not severe enough to outweigh the repository and release evidence.

Release historycaution

The package has existed for over 10 years with 26 releases, but it has had no release in the last 12 months despite its latest release being in April 2025. This indicates slowing maintenance rather than abandonment on its own.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with no releases in the last year, this lowers confidence in current maintenance capacity, though the project is not archived.

Repo issue activitycaution

There are no open issues or pull requests, and no recent issue or pull-request activity. This is consistent with a quiet, stable project but gives little evidence of active maintenance.

Repo toolingcaution

The repository uses TypeScript and npm scripts for builds, but no security scanning tools were detected. The missing scanning is a modest hygiene gap, partly offset by the repository's security policy.