@aws-sdk/util-endpoints

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less independently verifiable despite the package's active, organization-backed project.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which weakens direct package-to-repository traceability. The organization-backed monorepo context partly compensates for this mismatch.

Repo toolingcaution

The repository uses established build and test tooling, but no security-scanning tools were detected. This is a modest transparency gap rather than evidence of unsafe maintenance.