@aws-sdk/client-cloudfront

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication provenance less transparent than it could be, but the package otherwise has strong repository and release evidence.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, Turbo, and bundlers. No security scanning tools were detected, which is a minor transparency gap but not evidence of abandonment.

Workflow auditcaution

All 12 workflows were analyzed with no injection, untrusted-checkout, or audit findings. Nine scope permissions at the job level and two use read-only permissions; seven of 24 action references are unpinned, a minor reproducibility concern.