@firebase/storage-compat

Build provenancecaution

No build attestation or staged publishing evidence was collected, leaving release provenance less transparent, although this is not evidence of a bad release by itself.

Maintainerscaution

Three of four publishing accounts use the Google domain, consistent with the organization-backed repository. One gmail.com publishing account, feiyang.chen, is an account-hygiene caution but does not indicate limited maintenance capacity.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention this exact package, which weakens direct package-to-repository transparency. The broader Firebase monorepo context partly explains the mismatch but does not remove the gap.

Repo toolingcaution

The repository uses established build tools including Nx, Rollup, Webpack, TypeScript, and Babel. No security-scanning tools were detected, leaving a modest tooling gap.

Version stabilitycaution

Version 0.4.6 is not a stable major version and 80% of recent releases are prereleases, which adds some maturity uncertainty despite the current release not being a prerelease.