postcss-cli

Build provenancecaution

The release has no attestation, trusted publisher identity, or staged-publishing provenance, leaving the artifact-to-source supply-chain link less transparent.

Repo bus factorcaution

Recent activity is highly concentrated: the top contributor made 17 of 18 commits, or about 94%, with only one other contributor active. Organization backing partially mitigates handoff risk, but the concentration remains a genuine caution.

Repo toolingcaution

The repository reports no build tool and no security-scanning tools. This is a maintenance and assurance gap, although the project is a relatively focused CLI repository.

Security policycaution

No security policy was found, reducing transparency around vulnerability reporting and response expectations.

Token permissionscaution

The only workflow lacks top-level token permissions, so its permissions are not explicitly constrained at workflow scope; no top-level write permission was observed.