css-selector-parser

Build provenancecaution

The release has no build attestation, trusted publisher, or staged-publishing evidence. This reduces publication transparency, though it does not by itself show that the package is unsafe or unmaintained.

Maintainerscaution

Only one registry account has publish access. The recent release and repository activity history provide some compensation, but a single publisher leaves limited redundancy if that maintainer becomes unavailable.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. Although a recent release offsets some concern, the current lack of commit activity weakens evidence of ongoing maintenance.

Repo toolingcaution

The repository uses TypeScript and npm build scripts, but no security-scanning tooling was detected. This is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

The repository has no published security policy. For a parser library this is a genuine disclosure-process gap, although it is partly offset by the repository's tests and established release history.