@google-cloud/common

Common components for Cloud APIs Node.js Client Libraries

Latest 8.2.0

NPM

91%

Total Score

healthy

Active, well-supported project with typed artifacts and only minor workflow audit gaps.

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. Strong repository activity and organization backing partly compensate, but do not remove the transparency gap.

Lifecycle scripts

The package has a prepare install-time script. This is a mild supply-chain and installation-complexity consideration, but the signal does not show malicious or unnecessary behavior.

Repo package mention

The linked repository name does not match the package and its README does not mention @google-cloud/common. This is consistent with a monorepo sub-package, but the package-to-repository link is less explicit than ideal.

Workflow audit

All 71 analyzed action references are pinned, and 17 workflows use read-only permissions. The audit is incomplete because 1 of 19 workflows failed analysis, and two high-confidence low-severity findings install packages outside a lockfile; the pull_request_target workflow has broad write permission but no reported untrusted checkout or script-injection sink.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

google-wombot

Direct Dependencies

Dependency	Last Release	Score
arrify Version ^2.0.0	—	—
extend Version ^3.0.2	—	—
duplexify Version ^4.1.3	—	—
html-entities Version ^2.5.2	—	—
retry-request Version ^9.0.0	—	—