@aws-sdk/util-locate-window

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, limiting release transparency, though the package has strong active-project and licensing evidence.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, and multiple bundlers; no security scanning tools were detected, a minor hygiene gap.

Workflow auditcaution

All 11 workflows were analyzed with no findings, no untrusted checkouts, and no script injection; however, 7 of 22 action references are unpinned and one workflow has top-level write permissions.