css-minimizer-webpack-plugin

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last 3 months. This is consistent with the archived status and reinforces the risk of stalled maintenance.

Repository archiveddanger

The linked repository is archived even though it was pushed recently on May 8, 2026. An archived source repository is a severe abandonment risk for a package developers may need to maintain or update.

Build provenancecaution

No build attestation or trusted-publisher identity is present. This weakens publication transparency, though it is a secondary concern compared with the repository state.

Lifecycle scriptscaution

The package runs a prepare lifecycle script during installation. This is not inherently unsafe, but it adds install-time behavior that consumers should account for.

Workflow auditcaution

All seven workflow action references are unpinned, which makes builds less reproducible, and a high-confidence audit found an adhoc package installation outside a lockfile. The workflows do use read-only permissions and have no untrusted checkout or script-injection findings, partly compensating for the hygiene gaps.