@nestjs/typeorm

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is recorded, leaving the registry artifact's build origin less independently verifiable.

Lifecycle scriptscaution

A prepare install-time script is present, adding build or installation behavior that consumers should understand before adoption. The signal does not show that the script is malicious or unusually risky.

Repo toolingcaution

The project uses TypeScript, Vitest, and npm build tooling, but no security-scanning tools were detected. The missing scanning is a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and disclosure expectations are not documented.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout, injection, or audit findings, and it has no top-level write permissions. However, all 4 of 4 action references are unpinned, weakening reproducibility and action supply-chain hygiene.