@grpc/proto-loader

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, leaving release origin less independently verifiable, although the package has an established repository and release history.

Lifecycle scriptscaution

A prepare script runs during installation, which adds build-time behavior and some supply-chain surface, but the available project and artifact evidence does not show it is unsafe.

Release historycaution

The package has 61 releases over about 8 years, but only one release in the last 12 months. The linked repository's recent activity partly offsets the slower registry cadence.

Repo toolingcaution

The project uses TypeScript and Gulp for builds, but no security-scanning tools were detected. The missing scanning tooling is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkouts or injection findings. However, all 8 of 8 action references are unpinned, creating a reproducibility and action-integrity hygiene concern.