postcss-values-parser

Build provenancecaution

No build attestation, trusted publisher, or staged publishing was reported. This limits release transparency, although it does not by itself show that the package is unsafe to depend on.

Dependency profilecaution

Four runtime dependencies form a moderate dependency surface for a parser library; this is usable but adds some maintenance exposure compared with a dependency-free package.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no visible organizational backing to compensate for the thin maintainer base.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release partly offsets this, but the lack of current repository activity is a meaningful maintenance concern.

Repo issue activitycaution

Only one issue and one pull request are open, with no issues or pull requests opened or closed in the last month. This is not abandonment by itself, but it provides little evidence of active community response.