unist-builder

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less transparent, though this is not severe by itself.

Release historycaution

The package has a long history and 12 releases, but it has had no registry release for about three years, which indicates a meaningful maintenance concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the roughly three-year release gap and lowering confidence in active maintenance.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security-scanning tooling was detected, leaving a modest process gap.

Workflow auditcaution

Both workflows were analyzed without audit findings, and the pull_request_target trigger has no untrusted checkout or script-injection sink. However, all four action references are unpinned, which weakens build reproducibility.