mjml-head-attributes

Build provenancecaution

The release has no build attestation or trusted publisher provenance, leaving publication integrity less transparent despite the package's otherwise strong maintenance record.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, which creates some uncertainty about package-to-repository linkage; the repository's monorepo structure partly explains the name mismatch but does not resolve the missing mention.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected, leaving a security-hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Token permissionscaution

All three workflows lack top-level permissions declarations and none declare read-only permissions, which weakens least-privilege clarity even though no top-level write permissions were detected.