@aws-sdk/client-cognito-identity

Build provenancecaution

The release has no attestation or trusted-publisher provenance, leaving the build and publication path less independently verifiable despite the package's strong maintenance evidence.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, which weakens package-to-source transparency. The AWS monorepo context makes a name mismatch ordinary, but the lack of a README mention remains a minor caution.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, and multiple bundlers. No security-scanning tools were detected, leaving a modest tooling gap.