@csstools/postcss-unset-value

Name lookalikedanger

The package resembles the much more established postcss package, and readme_identifies_as_lookalike is true. Although it is scoped under @csstools, this identity overlap creates a serious risk that consumers intended to choose postcss instead.

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a supply-chain transparency gap, although the repository's pinned workflows and security scanning provide some compensating hygiene.

Repo bus factorcaution

One contributor made 100% of the 276 recent commits. Organization backing partly offsets handoff risk, but the observed maintenance capacity remains concentrated.

Repo commit activitycaution

There were 276 commits in the last 3 months, showing strong activity, but all were made by one active maintainer. The activity is real yet dependent on a narrow contributor base.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so ownership of this package is less transparent. The organization-owned monorepo context reduces but does not eliminate that concern.