color-space

Build provenancecaution

The release has no attestation or trusted-publisher provenance. This limits publication transparency, although the package has substantial repository and release evidence supporting its maintenance story.

Lifecycle scriptscaution

A prepare script runs during installation or packaging. Its purpose is not shown here, so it adds some install-time complexity but is not by itself evidence of poor package health.

Repo bus factorcaution

One contributor made 100% of the 415 recent commits. Organization backing provides some handoff capacity, but no second active contributor is shown, so the concentration remains a maintenance concern.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling vulnerabilities, but it is not evidence that maintenance has stopped.

Workflow auditcaution

All three workflows were analyzed without high-confidence findings or untrusted checkouts, but all 9 action references are unpinned and two workflows grant top-level write permissions. These are workflow hygiene and token-scope concerns, not a severe risk on their own.