@csstools/postcss-sign-functions

Name lookalikedanger

The README identifies the package with the much larger postcss project, which has far more downloads and stable releases; despite the scoped namespace and plugin context, this creates a serious identity risk for consumers.

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, so publication cannot be independently tied to a verified build.

Repo bus factorcaution

All 349 recent commits came from one contributor, creating a meaningful continuity concern even though the repository is organization-owned.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, leaving some uncertainty about package-to-repository mapping; the shared organization and monorepo structure provide context but do not remove it.