@azure/core-auth

Build provenancecaution

No build attestation or trusted-publisher provenance was provided, leaving publication authenticity less transparent despite the package's strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @azure/core-auth, which creates some ownership ambiguity. The Azure organization and monorepo-style repository context provide partial compensation.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts, but no security-scanning tools were detected. The organization backing and active maintenance partly offset this tooling gap.

Workflow auditcaution

All 21 workflows were analyzed with no untrusted checkouts or script-injection findings; however, one workflow has top-level write permissions and high-confidence template-injection findings remain hygiene concerns. The low-confidence GITHUB_ENV findings and two ad hoc package installs add limited caution.