@azure/core-process

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, but it is partly offset by the organization-backed repository and established build tooling.

Release historycaution

This is a very new package, 44 days old, with only one release and no established release interval. That limits evidence of long-term maintenance and compatibility stability.

Repo package mentioncaution

The linked repository is a monorepo whose name does not match the package and whose README does not mention it. That makes package-to-source mapping less transparent, although the organization-backed monorepo context reduces the concern.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts, but no security scanning tools were detected. The missing scanning is a modest repository hygiene concern.

Workflow auditcaution

All 23 workflows were analyzed and most use read-only or job-level permissions, with only 9 of 802 action references unpinned. However, high-confidence template-injection findings include a pull_request_target workflow, and high-confidence ad hoc package installation findings remain workflow hygiene concerns.