@google-cloud/cloud-sql-connector

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving a supply-chain transparency gap despite the otherwise strong maintenance evidence.

Lifecycle scriptscaution

The package uses a prepare install-time script, which adds build-time behavior during installation but is not by itself evidence of poor package health.

Workflow auditcaution

All nine workflows were analyzed with no high- or medium-severity findings and all 28 action references pinned. A high-confidence low-severity adhoc-packages finding and one top-level-write workflow are minor hygiene concerns, while the pull_request_target trigger has no reported untrusted checkout or script-injection sink.