@aws-sdk/client-cognito-identity-provider

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded for the artifact. This is a transparency gap, but it is outweighed by the package's active release history and organization-backed repository.

Repo toolingcaution

The repository uses established build and test tooling including TypeScript, Vitest, Make, and npm scripts. No security-scanning tool was detected, leaving a modest tooling gap.

Workflow auditcaution

All 12 workflows were analyzed successfully with no audit findings, no untrusted checkouts, and no script-injection findings. Seven of 24 action references are unpinned, which is a minor reproducibility and update-integrity gap; most workflows scope permissions at job level, though one has top-level write access.