postcss-color-hex-alpha

Build provenancecaution

No build attestation or trusted publisher provenance is available, which leaves publication integrity less independently verifiable despite the package's otherwise strong project evidence.

Repo bus factorcaution

All 241 recent commits came from one contributor, which is a concentration risk; however, the repository is owned by an organization, so maintenance can be handed off and this is a cautionary resilience gap rather than a severe abandonment signal.

Repo package mentioncaution

The repository name does not match the package and its README does not mention postcss-color-hex-alpha, so the package-to-repository relationship is less transparent; the monorepo context makes a name mismatch understandable but does not remove the missing mention.