@azure/core-http-compat

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating some uncertainty about package-to-repository mapping. The Azure organization-backed monorepo context partly compensates for that concern.

Repo toolingcaution

The repository uses TypeScript, Turbo, and npm scripts, indicating an established build process. No security scanning tools were detected, a modest transparency gap that is outweighed by the project's other maintenance evidence.

Workflow auditcaution

All 21 workflows were analyzed with no untrusted checkouts or script-injection findings, and 18 use read-only permissions. High-confidence template-injection findings and two ad hoc package installs remain workflow hygiene concerns, but no dangerous trigger-and-sink combination was shown.