css-tree

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, limiting verification of how the registry artifact was produced.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. A recent release and recent repository push provide some compensation, but current development activity remains a maintenance concern.

Repo toolingcaution

The repository uses established build tooling, but no security-scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

No repository security policy was found, so the process for reporting and handling vulnerabilities is not documented.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 8 action references are unpinned, which weakens reproducibility and update integrity.