@larksuiteoapi/node-sdk

Build provenancecaution

No build attestation or trusted-publisher identity was detected, reducing release transparency; this is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Maintainerscaution

Four of six publish-access accounts use the bytedance.com domain, consistent with company-backed publishing. waanhappy uses a consumer 163.com address and larksuiteapi uses larksuite.com, so account hygiene warrants minor caution but does not indicate weak maintenance capacity.

Repo toolingcaution

The repository uses TypeScript, Rollup, and npm scripts for builds, but no security-scanning tools were detected; the missing scanning is a modest transparency gap.

Security policycaution

No repository security policy was detected, leaving vulnerability-reporting expectations unclear for a widely integrated SDK.