@anthropic-ai/claude-code

Build provenancecaution

No build attestation or staged publishing is reported, leaving the connection between source and published artifact less verifiable than it could be.

Lifecycle scriptscaution

The package runs both postinstall and prepare scripts, increasing installation complexity and the code executed during dependency setup.

Repo toolingcaution

No build tool or security-scanning tool was detected in the repository metadata, leaving a modest verification and security-hygiene gap.

Workflow auditcaution

All 14 workflows were analyzed with no untrusted checkout or script-injection findings, and six workflows scope permissions at job level. One high-confidence low-severity finding reports an ad hoc package install outside a lockfile, which weakens build reproducibility.