@csstools/postcss-normalize-display-values

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less transparent. This is a supply-chain transparency gap, but it is moderated by the active organization-backed repository and clean workflow audit.

Repo bus factorcaution

All 276 recent commits came from one contributor, creating a meaningful concentration risk. Organization backing partly offsets personal abandonment risk but does not remove the lack of a currently active second contributor.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the link does not clearly identify where this package is maintained. The organization-owned monorepo context makes a name mismatch ordinary, but the missing mention remains a transparency gap.