mjml-spacer

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported. This weakens release transparency, but it is a caution rather than a health verdict because the package has strong release and repository activity.

Repo package mentioncaution

The repository name does not match mjml-spacer and its README does not mention the package. A name mismatch can be normal for a monorepo, but the absence of both a matching name and README mention creates some uncertainty about package-to-repository linkage.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected. The build setup is present, while the missing scanning reduces security-process transparency.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations and disclosure procedures undocumented.

Token permissionscaution

All three workflows lack top-level permissions declarations, and none declares read-only permissions. Although no top-level write permissions were observed, explicit least-privilege configuration is incomplete.