@google-cloud/functions-framework

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's otherwise established release history.

Lifecycle scriptscaution

A prepare lifecycle script runs during installation. This adds some installation complexity, but the signal alone does not show unsafe behavior or make the release unsuitable.

Security policycaution

The repository has no SECURITY.md policy, which is a transparency gap for reporting and handling vulnerabilities, though automated security scanning partly compensates for the missing policy.

Workflow auditcaution

All nine workflows were analyzed and use read-only permissions, with no untrusted checkouts or script injection. The audit reports high-severity cache-poisoning patterns only at low confidence, while trusted publishing is flagged with high confidence and warrants a modest supply-chain hygiene concern.