unist-util-position

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase CI risk if untrusted pull-request content is handled unsafely; no untrusted checkout or script injection was detected, limiting the concern.

Release historycaution

The package has existed since 2016 with 13 releases, but it has had no releases in the last three years. That long gap lowers confidence in ongoing maintenance despite the package's maturity.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, matching a roughly three-year period without observable updates and increasing abandonment risk.

Repo issue activitycaution

There are no open issues or pull requests and no recent activity, which is consistent with a small stable utility but provides no evidence of current support.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest transparency and assurance gap.