@azure-rest/core-client

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving release-to-source verification weaker than it could be despite the strong repository and release activity.

Repo package mentioncaution

The linked repository name differs from the package and its README does not mention the package, which creates some uncertainty about direct package-to-repository traceability; the mismatch is also consistent with this package being a sub-package in the Azure monorepo.

Repo toolingcaution

TypeScript and Turbo provide established build tooling, but no repository security-scanning tools were detected; the missing scanning coverage is a modest hygiene concern, not evidence of abandonment.

Token permissionscaution

Most workflows use read-only permissions, but two lack top-level permissions and one declares top-level write access, creating a limited workflow-hardening concern.