@azure/keyvault-common

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, so consumers receive less evidence about how this release was produced.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some ownership-transparency uncertainty, though the organization-backed monorepo context partly compensates.

Repo toolingcaution

The repository uses TypeScript, Turbo, and npm scripts for builds, but no security scanning tools were detected, leaving a modest tooling gap.

Version stabilitycaution

Version 2.1.0 is a stable major release and is not a prerelease, although 95% of recent versions were prereleases, which adds a minor stability concern.

Workflow auditcaution

All 21 workflows were analyzed with no untrusted checkouts or script-injection findings; however, one workflow grants top-level write access, nine of 807 action references are unpinned, and high-confidence template-injection findings remain workflow hygiene concerns.