unist-util-visit

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, a mild maintenance concern, but the recent release provides compensating evidence.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest hygiene gap.

Workflow auditcaution

Both workflows were analyzed without findings or untrusted checkouts, but all four action references are unpinned; the pull_request_target trigger has no dangerous sink here.