@aws-sdk/client-bedrock

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, leaving publication origin less independently verifiable despite the package’s strong maintenance evidence.

Repo package mentioncaution

The linked repository is a monorepo whose name does not match this package and whose README does not mention it directly; this creates a package-to-source mapping concern, although the monorepo structure makes the name mismatch unsurprising.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript and Vitest. No security scanning tools were detected, which is a minor transparency gap.

Workflow auditcaution

All 12 workflows were analyzed with no reported audit findings, no untrusted checkouts, and no script-injection paths. Seven of 24 action references are unpinned, creating a limited reproducibility and action-substitution risk.