mjml-head-html-attributes

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving publication provenance less transparent than it could be. This is a genuine supply-chain hygiene gap, but not evidence of abandonment by itself.

Repo package mentioncaution

The linked repository is a monorepo whose name does not match the package, which is ordinary for a sub-package, but it also does not mention this package in its README. That combination weakens the linkage and warrants verifying that the release is genuinely produced from this repository.

Repo toolingcaution

The repository uses Babel and npm scripts for builds, but no security-scanning tools were detected. The build setup is present, while security automation remains a hygiene gap.

Security policycaution

No security policy was found in the linked repository, reducing transparency for vulnerability reporting and response. Active maintenance and organization ownership partially mitigate the concern but do not remove it.

Token permissionscaution

All three workflows lack top-level permissions declarations, although none declares top-level write permissions and one has job-level permissions only. Explicit least-privilege declarations would improve workflow security hygiene.