postcss-color-rebeccapurple

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving the artifact-to-source publishing path less transparent.

Repo bus factorcaution

Only one contributor made all 241 recent commits, creating a meaningful continuity and bus-factor concern. The organization-owned repository partly compensates because maintenance can potentially be handed off within the project.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the linkage is less transparent and the package may be a monorepo subpackage or otherwise insufficiently identified.

Token permissionscaution

Four workflows declare read-only permissions and none omit top-level permissions; one workflow has top-level write permissions, a limited hardening concern mitigated by the otherwise explicit permission posture.