@google-cloud/projectify

Build provenancecaution

No build attestation or trusted-publisher provenance is present, reducing release transparency despite the package's otherwise strong maintenance evidence.

Dangerous workflowscaution

One pull_request_target workflow is present, creating some privileged workflow exposure, but no untrusted checkouts or script-injection patterns were detected across the analyzed workflows.

Lifecycle scriptscaution

A prepare install-time lifecycle script is present, which adds build or installation behavior that should be understood before adoption, although this signal alone does not show harmful behavior.

Repo package mentioncaution

The linked repository is a monorepo whose name differs from the package and whose README does not mention this package. A name mismatch is normal for a monorepo, but the lack of a README reference leaves some uncertainty about the exact package linkage.