unist-util-stringify-position

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent. This is a supply-chain transparency gap, not evidence that the package is malicious.

Dangerous workflowscaution

One of two workflows uses pull_request_target, which increases CI configuration risk compared with ordinary pull-request workflows. No untrusted checkout or script-injection pattern was detected, limiting the concern.

Release historycaution

The package has existed since 2016 with 13 releases, but its latest release was about three years ago and there were no releases in the last 12 months. That slows confidence in ongoing maintenance, although the long history provides some maturity evidence.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the older last release, this is the strongest maintenance concern, though the package may be mature and stable.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected. The build setup supports maintainability, while the missing scanning is a modest transparency gap.