@aws-sdk/token-providers

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, but the active organization-backed repository and stable release history provide compensating evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which warrants caution because the linkage is less explicit. However, the organization-owned AWS SDK monorepo and package namespace provide meaningful compensating context for a sub-package.

Repo toolingcaution

The project uses established build and test tools and has a build system, but no security-scanning tools were detected. The repository's separate security policy provides some compensating process evidence.

Workflow auditcaution

All 12 workflows were analyzed successfully with no findings, no untrusted checkouts, and no script-injection paths. Seven of 24 action references are unpinned, a minor reproducibility and update-integrity concern, while scoped or read-only permissions cover 11 workflows.