css-functions-list

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, reducing release transparency. This is a traceability gap rather than evidence that the release is unsafe.

Lifecycle scriptscaution

A prepare install-time script is present. This is a mild review point because installation runs package-defined work, although no additional evidence here shows that it is unsafe or unusually broad.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release history partly offsets this, but the short-term activity gap lowers confidence in active maintenance.

Repo toolingcaution

The repository uses TypeScript, Rolldown, npm scripts, and SWC for builds, showing an established build setup. No security-scanning tools are configured, which is a modest hygiene gap.

Security policycaution

The repository has no security policy. For a small data package this is not severe, but it provides less guidance for reporting and handling vulnerabilities.