@google-cloud/promisify

Build provenancecaution

No build attestation or trusted-publisher provenance was observed, leaving publication origin less independently verifiable. The active organization-backed repository and build tooling provide partial practical compensation.

Dangerous workflowscaution

One of 18 analyzed workflows uses pull_request_target, but there are no untrusted checkouts or script-injection findings. The isolated workflow concern is limited rather than severe.

Lifecycle scriptscaution

The package defines a prepare install-time script, which adds some installation complexity and execution surface. No evidence indicates that this script is harmful, so this is a limited concern.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about the exact package-to-source linkage. The organization-owned Google Cloud monorepo context makes a subpackage explanation plausible, so the concern is limited.