@aws-amplify/cli

Build provenancecaution

No build attestation or trusted publisher provenance is present, leaving the relationship between the published artifact and its source less independently verifiable.

Lifecycle scriptscaution

A postinstall script runs during installation, adding operational and supply-chain complexity. This is a caution rather than a severe risk because the package is an established CLI with a linked, actively maintained source repository.

Package scaffoldingcaution

The published artifact lacks a README, which is a minor usability gap, but it includes a changelog and release notes for this exact version, while the repository has tests and a changelog.

Token permissionscaution

Some workflows grant top-level write permissions and two lack top-level permission declarations, which increases workflow privilege exposure. This is moderated by the absence of detected dangerous workflow patterns and the presence of CodeQL scanning.