@firebase/remote-config

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving release provenance less transparent than it could be, though this is not evidence of a defective release.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @firebase/remote-config, creating some ownership-transparency concern. The package README identifies it as a Firebase JS SDK component, which partly explains the monorepo mismatch but does not remove the signal’s caution.

Repo toolingcaution

The project uses established TypeScript, Rollup, Webpack, Babel, Nx, and npm tooling. No automated security-scanning tools were detected, but the repository does provide a security policy.

Version stabilitycaution

Version 0.9.3 is not a stable major release and 75% of recent versions are prereleases, which adds some maturity uncertainty despite the current release itself not being marked prerelease.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, and permissions are read-only or job-scoped. The high-confidence adhoc-packages finding shows an end-to-end workflow installs a package outside its lockfile; the low-confidence cache-poisoning finding is hygiene at most.