mjml-parser-xml

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving release-origin verification weaker than it could be. This is a transparency caution rather than a health verdict by itself.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent than expected and the package could be a monorepo subpackage without explicit documentation.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools are reported. The build tooling is positive while the missing security scanning is a moderate hygiene gap.

Security policycaution

No repository security policy is present, reducing transparency around vulnerability reporting and response expectations.

Token permissionscaution

All three workflows lack top-level token permissions declarations, and none is explicitly read-only. Although no top-level write permissions were detected, explicit least-privilege configuration would provide stronger workflow hygiene.