@aws-sdk/client-ssm

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, which leaves publication verification less transparent, although the package has strong release and repository activity.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, so the package-specific relationship is less explicit; however, the package is part of an AWS SDK monorepo, where a name mismatch is expected.

Repo toolingcaution

The project uses established build and test tooling and has a working build pipeline; the collected signal does not show dedicated security scanning, which is a minor hygiene gap.