l3aro/html-toc

Release historycaution

The package is nearly two years old but has had no releases in the last 12 months; only three releases were published, all clustered at the start of the project. This indicates limited release maintenance, though the current version is stable.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That suggests limited current maintenance capacity, despite the repository not being archived.

Security policycaution

The repository has no security policy. This is a transparency and reporting gap, but it is less significant for a small package because dependency scanning is enabled.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. The high-confidence bot-conditions finding in the Dependabot auto-merge workflow is a further workflow hygiene concern, although no untrusted checkout or script injection was detected.