postcss-modules

Lifecycle scriptscaution

A prepare script runs during installation or packaging. This is not inherently unhealthy, but it adds build behavior that consumers should account for.

Repo bus factorcaution

Two contributors were active in the last 3 months, but one made 34 of 35 commits, leaving maintenance highly concentrated.

Repo toolingcaution

The project uses build tooling, but no security scanning tools were detected. That is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, so there is no documented process for reporting or handling vulnerabilities.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, both of its two action references are unpinned, weakening build reproducibility.