@azure/core-client

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, which leaves release-to-source verification weaker than ideal, but this is a transparency caution rather than evidence of abandonment.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @azure/core-client, which weakens package-to-repository transparency. The organization-owned monorepo provides some compensating context, but the explicit association remains unclear.

Repo toolingcaution

TypeScript and Turbo provide established build tooling, but no repository security-scanning tools were detected, leaving a modest security-process gap.

Token permissionscaution

Most workflows declare read-only permissions, but two lack top-level permissions and one has top-level write access, creating a limited workflow-hardening concern.