@aws-sdk/client-athena

Build provenancecaution

No build attestation or trusted-publisher provenance was provided, leaving publication provenance less transparent than it could be, although this is not evidence of a compromised release.

Repo package mentioncaution

The linked repository is a monorepo and neither matches the package name nor mentions it in the README, so package-specific ownership is less explicit. The AWS organization backing and package tree under the repository partly compensate, but this remains a transparency caution.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, and multiple bundlers, but no security scanning tools were detected. The missing scanning is a modest hygiene gap rather than an abandonment signal.

Workflow auditcaution

All 12 workflows were analyzed with no audit findings, no untrusted checkouts, and no script injection. Seven of 24 action references are unpinned and one workflow has top-level write permissions, but scoped permissions elsewhere and the clean audit keep this a minor concern.