@csstools/postcss-cascade-layers

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable than it could be.

Repo bus factorcaution

One contributor made 100% of the 436 recent commits. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

There were 436 commits in the last 3 months, but only one active maintainer made them, so activity is high but concentrated.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, creating some uncertainty about package-to-repository identity; the monorepo context partly explains the name mismatch but not the absent mention.

Workflow auditcaution

All 5 workflows were analyzed successfully, all 10 action references are pinned, and 4 workflows use read-only permissions. One workflow has top-level write permissions, but no untrusted checkout, injection, or audit findings were reported.