@google-cloud/precise-date

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the exact registry-to-source build path less transparent. This is a meaningful transparency gap, but it is offset partly by the active organization repository and security controls.

Dangerous workflowscaution

One of 19 workflows uses pull_request_target, which warrants review because that trigger can expose write-capable automation. However, no untrusted checkouts or script-injection patterns were detected.

Lifecycle scriptscaution

The package uses a prepare install-time lifecycle script. This adds some installation complexity and execution risk, although the broader repository evidence shows established build and security practices.

Repo package mentioncaution

The package is hosted in a large monorepo whose name does not match the package and whose README does not mention it. The organization-backed monorepo context makes this plausible for a sub-package, so this is only a minor transparency concern.