@azure/abort-controller

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving release origin less independently verifiable despite the package's strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which creates some uncertainty about package-to-repository mapping; the Azure monorepo context partly explains the mismatch but does not remove it.

Repo toolingcaution

TypeScript, Turbo, and npm scripts provide an established build setup, but no security-scanning tools were detected, leaving a modest tooling gap.

Workflow auditcaution

All 21 workflows were analyzed, with no untrusted checkout or script-injection findings. The audit still found high-confidence template-injection patterns, low-confidence GITHUB_ENV findings, two ad hoc package installs, and one workflow with top-level write permissions; these are workflow hygiene concerns rather than a demonstrated release compromise.