postcss-normalize

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less verifiable. This is a transparency weakness but not evidence that the release is unsafe by itself.

Release historycaution

The package has 24 releases over more than 11 years, but none in the last 12 months and the latest release was nearly two years ago. This indicates materially slowed publishing and raises maintenance concerns.

Repo commit activitycaution

There were no commits and no active maintainers in the past three months, a meaningful sign of slowed maintenance. The repository's push about six months ago prevents this from being treated as clear abandonment.

Repo issue activitycaution

There are only three open issues and no recent issue or pull-request activity. This is consistent with a quiet, mature project, but provides little evidence of current responsiveness.

Repo toolingcaution

The repository uses build tooling, but no security-scanning tools were detected. The missing scanning layer is a modest maintenance and hygiene gap, partly offset by the repository's other controls.