@aws-sdk/util-endpoints

Build provenancecaution

The release has no build attestation or trusted-publisher metadata, leaving publication provenance less independently verifiable despite the package's strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the linkage is less explicit; this is a caution even though the package may be a subpackage of the monorepo.

Repo toolingcaution

The repository uses established build and test tooling, but no security-scanning tools were detected, leaving a modest security-process gap.