semmelsamu/commonmark-extensions

Maintainerscaution

Only one registry account has publishing access. The repository is user-owned rather than organization-backed, so there is no provided evidence of a broader publishing base to offset this concentration.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although it has a recent release, the current absence of development activity leaves maintenance continuity uncertain.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a transparency and maintenance gap, not evidence that the package is unsafe.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear for consumers.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, which weakens build reproducibility and supply-chain hygiene.