@azure/core-util

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported. This reduces release transparency even though the package has strong maintenance evidence.

Dangerous workflowscaution

Eight workflows use pull_request_target, which warrants review because that trigger can access elevated repository context. However, no untrusted checkouts or script-injection patterns were detected in the analyzed workflows.

Repo package mentioncaution

The linked repository name does not match the package name, and its README does not mention @azure/core-util. The Azure organization backing and the package README's description of Azure SDK usage make the monorepo relationship plausible, but package-specific repository traceability is still weaker.

Repo toolingcaution

The repository uses TypeScript, Turbo, and npm scripts for builds, but no security scanning tools were detected. The build process is established, while security-tooling coverage is a transparency gap.

Token permissionscaution

Eighteen workflows declare read-only permissions, but two omit top-level permissions and one declares top-level write access. This is a limited workflow-hardening concern rather than evidence of unfit maintenance.