@grpc/grpc-js

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving release provenance less transparent than it could be. This is a supply-chain transparency gap rather than evidence that the release is unsafe.

Lifecycle scriptscaution

A prepare script runs during installation or package preparation. This is a mild supply-chain and reproducibility consideration, but the signal does not show suspicious behavior or an excessive script set.

Maintainerscaution

Two of three publishing accounts use the Google domain, consistent with the organization-backed project. The outside-domain account nicolasnoble (nobis-crew.org) is an account-hygiene caution, not evidence of limited maintenance capacity.

Repo toolingcaution

The project uses TypeScript and Gulp, but no security scanning tools were detected. The missing scanning is a modest process gap because a security policy and active review signals are present.

Workflow auditcaution

The single workflow was fully analyzed, has read-only permissions, no untrusted checkout or injection findings, and no audit findings. However, all 8 action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.