remark-squeeze-paragraphs

Build provenancecaution

No build attestation, trusted publisher, or staged publishing evidence is available, leaving publication provenance less transparent.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase CI exposure if untrusted changes are handled unsafely; no untrusted checkout or script-injection patterns were detected to offset the concern partially.

Release historycaution

The package is mature, with releases dating back to 2016, but it has had no release in the last 12 months and the latest release was September 2023, creating a meaningful maintenance concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months; combined with the old latest release, this leaves little evidence of ongoing maintenance.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected, reducing security-process transparency without making the package unfit on its own.