unist-util-is

Build provenancecaution

No build attestation, trusted publisher, or staged publishing was detected, so consumers cannot verify the package's build origin from registry metadata.

Repo commit activitycaution

There were zero commits and zero active maintainers during the latest three months. This is a mild maintenance concern for future fixes, partly offset by the recent release and repository push.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tool was detected, leaving automated security coverage unclear.

Workflow auditcaution

Both workflows were analyzed without audit findings or untrusted checkout and script-injection sinks, and none has top-level write permissions. However, all four action references are unpinned, which weakens build reproducibility and update safety.