mjml-wrapper

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release-to-source provenance less transparent.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, which creates a provenance and package-association ambiguity. The monorepo structure makes a name mismatch ordinary, but the absence of a README mention remains a genuine caution.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools are reported, leaving a modest security-hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Token permissionscaution

All three workflows lack top-level permissions declarations and none declares read-only permissions, which weakens least-privilege clarity even though no top-level write permissions were detected.