postcss-selector-parser

Build provenancecaution

No build provenance attestation or trusted publisher identity is present, reducing publication traceability and reproducibility assurance.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation, adding some supply-chain and reproducibility surface; no provided signal shows that it is malicious or unusually complex, so this is a moderate hygiene concern.

Repo bus factorcaution

One contributor made 15 of 19 recent commits, an 83.3% share, which creates concentration risk; the organization-backed repository and two additional active contributors partly compensate but do not eliminate it.

Repo toolingcaution

The repository uses TypeScript build tooling, but no security-scanning tools were detected, leaving a security-process gap despite the presence of a structured build.

Token permissionscaution

The only workflow lacks a top-level permissions declaration, so its effective token permissions are less explicit than recommended; no workflow-level write permissions were detected.