@firebase/ai

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than it could be. This is moderated by the active organization-backed project and strong release history.

Maintainerscaution

Three of four publishing accounts use the Google domain, consistent with the organization-backed repository. feiyang.chen (gmail.com) is an outside consumer account, so account hygiene is a minor caution rather than evidence of weak maintenance capacity.

Repo package mentioncaution

The repository name does not match @firebase/ai and its README does not mention the package. Although a monorepo name mismatch is normal, the absence of a package mention leaves a small linkage concern.

Repo toolingcaution

The repository uses established build tooling including Nx, TypeScript, Rollup, Webpack, and Babel. No security-scanning tooling was detected, which is a modest transparency gap for a widely used SDK.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, permissions are read-only or job-scoped, and no untrusted checkout or script injection was found. The audit still found high-confidence low-severity adhoc package installation and a low-confidence cache-poisoning pattern, so workflow hygiene is a minor caution.