@google-cloud/pubsub

Lifecycle scriptscaution

The package has a prepare install-time lifecycle script. This is a transparency and installation-complexity consideration, but the provided signals do not show harmful behavior.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating some uncertainty about package-to-repository linkage. The organization-owned monorepo context partly explains the mismatch but does not remove the transparency gap.

Workflow auditcaution

All 71 analyzed action references are pinned and 17 workflows use read-only permissions, but one of 19 workflows failed analysis and two high-confidence low-severity findings report packages installed outside a lockfile.