rtlcss

Build provenancecaution

No build provenance attestation or trusted-publisher configuration was observed, so consumers cannot independently verify how this release was published. This lowers transparency but is not severe on its own.

Release historycaution

The package has a substantial history with 68 releases since 2014, but its latest registry release was in August 2024 and there were no releases in the following two years, indicating slowed maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers during the last three months, which is a meaningful maintenance warning despite the project's long history.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented. This is a modest transparency gap, not evidence that the package is unsafe.

Workflow auditcaution

All eight analyzed action references are unpinned, creating avoidable build reproducibility and action-substitution risk. The audit found no dangerous triggers, injection sinks, permission problems, or other reported findings, which partly offsets the gap.