retext-stringify

Build provenancecaution

No build attestation or trusted-publisher metadata is available, leaving publication provenance less transparent than it could be.

Release historycaution

The package has 10 releases over more than 10 years, but none in the last 12 months and the latest release was nearly three years ago, indicating slow maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months; the February 2025 push provides some compensation but does not remove the recent inactivity concern.

Repo toolingcaution

The repository uses TypeScript and npm scripts, but no security-scanning tools were detected, leaving a modest hygiene gap.

Workflow auditcaution

All four analyzed action references are unpinned, which weakens workflow reproducibility. The pull_request_target workflow has no untrusted checkout or script-injection sink, and no high- or medium-severity findings were reported.