@azure/msal-common

Build provenancecaution

The release has no build attestation or trusted-publisher identity, leaving publication provenance less independently verifiable despite the package's otherwise strong project evidence.

Maintainerscaution

Two of three registry publisher accounts use microsoft.com, consistent with the organization-backed project. The neagrawa account uses gmail.com, which is a minor account-hygiene concern rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match the package name and its root README does not mention @azure/msal-common. This is a transparency caution, although the package is described as an internal package dependency and the repository is an apparent monorepo.