@azure/storage-common

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, leaving publication origin less independently verifiable. The package's strong release and repository activity provide some compensating evidence, so this is a minor gap rather than a severe risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the linkage is less explicit; however, the Azure organization backing and monorepo context partly compensate for this concern.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts. No security-scanning tooling was detected, which is a minor transparency gap but is outweighed by the project's other maintenance evidence.

Workflow auditcaution

All 21 workflows were analyzed with no untrusted checkouts or script-injection findings, and 18 use read-only permissions. High-confidence template-injection findings and two ad hoc package installations remain workflow hygiene concerns, while low-confidence GITHUB_ENV findings carry limited weight.