parse5

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent even though other repository and release signals are healthy.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor maintenance concentration has no visible organizational handoff signal to offset it.

Repo bus factorcaution

One contributor made all six commits in the last three months, creating a real concentration risk for continuity despite the repository's current activity.

Token permissionscaution

Two workflows use read-only permissions, but one workflow lacks top-level permissions and another requests write access, leaving some workflow permission hardening incomplete.