postcss-focus-visible

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the otherwise healthy project evidence.

Repo bus factorcaution

One contributor made 100% of the 276 recent commits, creating a meaningful continuity risk. Organization ownership provides some ability to hand off maintenance, so this is caution rather than danger.

Repo commit activitycaution

The repository recorded 276 commits in the last three months, strong activity overall, but all activity came from one active maintainer.

Repo package mentioncaution

The linked monorepo neither matches the package name nor mentions it in its README, so the package-to-repository relationship is less transparent; the organization ownership provides some context but does not remove the gap.

Workflow auditcaution

All five workflows were analyzed with no audit findings, all actions are pinned, and four workflows use read-only permissions. One workflow has top-level write permissions, a mild hygiene concern without an untrusted checkout or injection sink.