stylelint-scss

Build provenancecaution

No build attestation or trusted-publisher identity is available, so consumers cannot independently verify that the registry artifact came from the reviewed source. The transparent repository and matching package mention partly offset this gap.

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script, which adds some installation complexity and supply-chain exposure, though no other evidence here indicates unsafe workflow behavior.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations less clear for users and contributors.

Token permissionscaution

Two workflows declare read-only permissions, and none declare top-level write access; one code-scanning workflow lacks top-level permissions, which is a minor configuration gap.