@google-cloud/promisify

Lifecycle scriptscaution

The package defines a prepare install-time script. This adds build-time behavior, but the available signals do not show that it is unsafe or unusually complex.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some linkage uncertainty. The organization-owned monorepo context makes a subpackage layout plausible but does not remove the transparency gap.

Workflow auditcaution

The audit analyzed 18 of 19 workflows, so coverage is incomplete. It found two high-confidence low-severity adhoc-package installations, but all 71 analyzed action references are pinned and there are no high- or medium-severity findings.