@aws-sdk/client-secrets-manager

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less verifiable than it could be despite the package's strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which is a transparency concern; the package file tree nevertheless places the client in the AWS SDK v3 monorepo.

Repo toolingcaution

The repository uses established build and test tooling, but no security-scanning tools were detected; the separate security policy and clean workflow audit partly compensate.

Workflow auditcaution

All 12 workflows were analyzed with no audit findings, no untrusted checkouts, and no script injection; seven of 24 action references are unpinned and one workflow has top-level write permissions, so workflow hygiene is not perfect.