talleu/md-to-ooxml

The MIT license, focused dependency set, README, and extensive tests make adoption straightforward. Maintenance evidence is limited for this young package, and its CI uses 13 unpinned actions; pin v0.1.2 if adopting.

Latest v0.1.2

Packagist

64%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

All three releases arrived within roughly 3 hours, with no later registry releases across the package's 174-day history. That short initial burst leaves limited evidence of sustained release maintenance.

Repo commit activity

The repository recorded no commits and no active maintainers during the last 3 months, although it was pushed roughly 4 months after publication. The recent inactivity weakens evidence of ongoing maintenance.

Security policy

The linked repository has no security policy. This is a transparency and issue-reporting gap, though it is not by itself evidence that the package is unsafe.

Version stability

v0.1.2 is not a prerelease, but the package remains on the 0.x major line and has only three releases. This suggests an immature API rather than an established stable contract.

Workflow audit

The single workflow was fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. However, all 13 action references are unpinned, leaving avoidable build-integrity and maintenance risk.