@aws-sdk/client-cloudformation

Build provenancecaution

No build attestation or trusted-publisher identity was provided, leaving publication provenance less transparent despite the package’s strong maintenance and organizational backing.

Repo package mentioncaution

The linked monorepo name does not match the package and its README does not mention @aws-sdk/client-cloudformation, so package-to-repository ownership is less directly transparent; the AWS organization backing reduces but does not remove this concern.

Repo toolingcaution

The repository uses established build and test tooling, but no security-scanning tool was detected; the separate security policy and clean workflow audit partly compensate for that gap.