@asamuzakjp/css-color

Build provenancecaution

The release has no registry build attestation or trusted-publisher provenance. This limits verification of how the artifact was produced, though it is not evidence of maliciousness by itself.

Maintainerscaution

Only one registry account has publish access, matching the single-user repository ownership and increasing publishing continuity risk. Recent repository activity provides some compensation but not a second publishing path.

Repo bus factorcaution

One contributor made 74 of 77 commits, or about 96%, in the last three months. The other three contributors made only one commit each, leaving meaningful single-maintainer continuity risk.

Workflow auditcaution

All workflows were analyzed successfully, one workflow uses read-only permissions, and no injection, unsafe checkout, or audit findings were reported. Both of the two action references are unpinned, which is a modest reproducibility and supply-chain hygiene gap.