postcss-sort-media-queries

Lifecycle scriptscaution

A prepare script runs during installation, which adds build-time behavior and some supply-chain exposure, but this signal alone does not indicate an unsafe package.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single person and increasing abandonment risk.

Repo toolingcaution

The repository uses Vitest, esbuild, and npm scripts, indicating an established build and test setup, but no security scanning tools were detected.

Security policycaution

No repository security policy was found, reducing transparency around vulnerability reporting, though this is a moderate hygiene gap rather than evidence of abandonment.