@aws-sdk/client-personalize-events

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded for this release, leaving publication origin less independently verifiable. The package's established release history and organization backing provide partial compensation.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the package-to-source relationship is not explicit. The monorepo structure and AWS organization backing partly compensate, but this remains a transparency concern.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, and multiple build tools. No security-scanning tool was detected, which is a minor hygiene gap but is outweighed by the other maintenance evidence.

Workflow auditcaution

All 12 workflows were analyzed with no audit findings, no untrusted checkouts, and no script injection. Seven of 24 action references are unpinned and one workflow has top-level write permissions, so workflow hygiene is good but not perfect.