mjml-migrate

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's active project signals.

Dependency profilecaution

Six runtime dependencies are reasonable for this tool, though the dependency surface creates some transitive maintenance exposure.

Repo package mentioncaution

The repository name does not match mjml-migrate and its README does not mention the package. This can be normal for a monorepo subpackage, but the lack of an explicit mention weakens package-to-repository transparency.

Repo toolingcaution

The project uses Babel and npm scripts, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less transparent.