beasties

Dangerous workflowscaution

One of six workflows uses pull_request_target, but no untrusted checkouts or script-injection patterns were detected. The isolated elevated workflow pattern merits review without indicating a severe workflow risk from the collected data.

Dependency profilecaution

The package declares 9 runtime dependencies and 3 development dependencies. This is a meaningful dependency surface for a lightweight CSS/HTML processing tool, but not by itself evidence of poor health.

Maintainerscaution

Only one registry account, danielroe, has publish access. This creates some publishing continuity risk, although repository activity and provenance provide compensating evidence of active ownership.

Project backingcaution

The repository is owned by the individual user danielroe rather than an organization. This does not negate the strong observed activity, but it means the single-owner and contributor-concentration concerns are not offset by explicit organizational backing.

Repo bus factorcaution

The top contributor accounts for about 69% of recent commits, which is somewhat concentrated; however, four additional contributors were active during the same period, reducing the abandonment risk to a caution rather than a severe concern.