@firebase/app-check-interop-types

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which is a caution under this signal; however, the organization-backed monorepo and matching @firebase namespace provide compensating context.

Repo toolingcaution

The repository uses established build tooling, though no security-scanning tools were detected. The separate security policy and active maintenance partly compensate for that gap.

Version stabilitycaution

Version 0.3.5 is not a prerelease, although the recent prerelease share is high and the package remains below 1.0, which warrants some caution about API stability.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, and permissions are read-only or job-scoped. The low-confidence cache-poisoning result is hygiene at most, while high-confidence adhoc package installation is a minor workflow concern.