@aws-sdk/client-ecr

Build provenancecaution

No build attestation or trusted-publisher identity was recorded, leaving release provenance less verifiable than it could be; the package's long release history and active organization-backed repository provide compensating evidence.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @aws-sdk/client-ecr, so package ownership is less directly transparent; the AWS organization backing and monorepo structure partly compensate.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, Turbo, and bundlers; security-scanning tools were not detected, which limits this signal's assurance but does not outweigh the maintenance evidence.