postcss-custom-properties

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, so consumers receive less evidence about how the published artifact was produced. This is a transparency gap rather than evidence of an unsafe release.

Repo bus factorcaution

One contributor made all 349 commits in the last three months. Organization ownership provides some handoff capacity, but no second recent contributor is shown, leaving a genuine continuity risk.

Repo commit activitycaution

The repository recorded 349 commits in three months, demonstrating strong activity. However, all activity came from one active maintainer, so the maintenance evidence is concentrated.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention postcss-custom-properties. Although a monorepo can explain the name mismatch, the missing package reference leaves some uncertainty that this repository directly represents the package.