@aws-sdk/ec2-metadata-service

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable, but the active organization-backed project provides compensating context.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which warrants caution because the package-to-repository relationship is less explicit; the large monorepo context makes a subpackage explanation plausible.

Repo toolingcaution

The project uses established build and test tooling, including TypeScript and Vitest. No security scanning tools were detected, which is a modest transparency and hygiene gap, partly offset by the repository security policy.