@aws-sdk/client-cognito-identity-provider

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving release provenance less transparent even though the package has strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which creates a repository-mapping concern; the mismatch is otherwise consistent with a monorepo, so this is a limited caution.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, Turbo, and bundlers, although no security-scanning tools were detected.

Workflow auditcaution

All 12 workflows were analyzed with no audit findings, no untrusted checkouts, and no script injection. Seven of 24 action references are unpinned and one workflow has top-level write permissions, so workflow hygiene is good but not perfect.