lightningcss-win32-arm64-msvc

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between the published native binary and its build process less transparent. Other repository and release evidence provides some compensation, so this is a modest concern rather than a severe risk.

Repo package mentioncaution

The repository name does not match this platform-specific package and its README does not mention the package. Although this can occur for a monorepo subpackage, the collected evidence leaves the package-to-repository relationship less explicit.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected. This is a limited hygiene gap, not evidence of poor maintenance by itself.

Workflow auditcaution

All 49 analyzed action references are unpinned, and the audit found high-confidence use of long-lived publishing credentials; one workflow also grants top-level write access. No untrusted checkout or script-injection path was found, which limits the severity.