mjml-body

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release provenance less transparent despite the package's otherwise strong maintenance record.

Repo package mentioncaution

The repository name does not match mjml-body and its README does not mention the package, which creates some uncertainty about package-to-repository linkage; the monorepo file tree does contain packages/mjml-body, partially compensating for that gap.

Repo toolingcaution

Babel and npm build tooling are present, but no security-scanning tools were detected, leaving a security-process hygiene gap.

Security policycaution

The repository has no security policy, reducing vulnerability-reporting transparency and maintainer guidance for security issues.

Token permissionscaution

All three workflows lack top-level token permissions and none declares read-only permissions; although no workflow has top-level write permissions, the explicit least-privilege posture is incomplete.