mjml-head-title

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving release-to-source provenance less transparent.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in its README; although a name mismatch can be normal for a monorepo subpackage, the absence of a README mention warrants caution about package-to-repository traceability.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools are detected; the missing scanning is a transparency and defense-in-depth gap.

Security policycaution

The repository has no security policy, which makes vulnerability-reporting expectations less clear for dependents.

Token permissionscaution

All three workflows lack top-level permissions declarations, reducing least-privilege clarity even though none declares top-level write permissions and one uses job-level permissions.