lightningcss-linux-arm64-musl

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving release origin less verifiable. This is a transparency gap but not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match this platform-specific package and its README does not mention the exact package name. The mismatch is consistent with a native sub-package, but the missing README mention leaves a small identity-transparency gap.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected. This leaves a modest process gap without outweighing the observed maintenance activity.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and response expectations. This is a transparency gap, not an abandonment signal.

Workflow auditcaution

All 49 analyzed action references are unpinned, and high-confidence trusted-publishing findings indicate long-lived registry credentials; one workflow also has top-level write permissions. No untrusted checkouts or script injection were found, limiting the risk to build hygiene rather than a severe workflow exposure.