postcss-load-config

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, limiting publication transparency, but this is not by itself evidence that the release is unsafe to use.

Release historycaution

The package is mature with 30 releases, but its latest registry release was about two years and three months before collection and it had no releases in the last 12 months, which is a maintenance concern.

Repo bus factorcaution

All one recent commit came from a single contributor, creating concentration risk; organization ownership provides some capacity to hand maintenance off, so this is a caution rather than a severe risk.

Repo commit activitycaution

There was one commit in the last three months from one active maintainer, so maintenance is present but currently limited in volume.

Repo toolingcaution

The repository uses build tooling, but no security-scanning tools were detected, leaving a modest security-process gap.