@acemir/cssom

Build provenancecaution

No build attestation or trusted-publisher provenance is available. This leaves publication origin less transparent, but it is not by itself evidence that the release is unsafe.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This conflicts with the same-day release and recent merged pull requests, but still indicates limited directly observed development activity.

Repo toolingcaution

The project uses npm build tooling but has no detected security-scanning tools. The missing scanning is a hygiene gap, while the build tooling supports a reproducible project structure.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, though the release notes document a CVE-related fix and the absence is not an abandonment signal.

Type declarationscaution

The package provides no type declarations. For a JavaScript CSS parser that consumers integrate as a library, this reduces developer ergonomics and adds a real, though not severe, adoption cost.