parse-css-color

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, reducing publication transparency, though this is a hygiene limitation rather than evidence of an unsafe release.

Maintainerscaution

One registry publisher creates a thin operational base, although the linked repository is clearly owned by the same individual and the package is small.

Release historycaution

The package has had no registry release in over four years, despite eight releases overall, which is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the risk that maintenance has slowed or stopped.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.