@google/genai

Build provenancecaution

No build attestation or trusted-publisher metadata was reported, leaving publication provenance less transparent than it could be, though this is not evidence of a faulty release.

Lifecycle scriptscaution

The package declares preinstall, prepack, and prepare scripts, which add install and packaging execution paths; their presence is a modest supply-chain hygiene concern.

Maintainerscaution

Two of three publishing accounts use the Google domain, while mrdoob (mrdoob.com) is outside the organization; this is a minor account-hygiene concern, partly offset by clear Google project backing.

Workflow auditcaution

All 18 analyzed action references are unpinned, which weakens reproducibility. The only cache-poisoning finding has low confidence and is therefore hygiene-level rather than a severe risk; one workflow also has top-level write permissions, while no untrusted checkout or script injection was found.