postcss-opacity-percentage

Workflow auditdanger

All four action references are unpinned, and a high-confidence audit finding reports spoofable actor checks in auto-merge.yml. One workflow also grants top-level write permissions, increasing automation hygiene risk.

Lifecycle scriptscaution

A prepare script runs during installation, which adds execution during package setup. No evidence shows that the script is unsafe, so this is a limited supply-chain hygiene concern rather than a severe risk.

Maintainerscaution

Only one registry account has publish access. That is a narrow publishing base, although the linked repository provides direct ownership context and does not by itself indicate abandonment.

Release historycaution

The package has made 10 releases since November 2021, but none in the last two years. Recent repository activity partly offsets the stale registry cadence, but the release gap still raises maintenance concern.

Repo commit activitycaution

The repository records no commits and no active maintainers in the last three months. Recent pushes and five merged pull requests provide some compensation, but the direct commit signal remains thin.