@temporalio/worker

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the publication path less independently verifiable despite the package's otherwise strong maintenance evidence.

Dependency profilecaution

Twenty runtime dependencies create meaningful dependency surface and maintenance exposure, although the package is a substantial worker SDK and the listed dependencies are coherent with that role.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent even though automated security scanning is present.

Token permissionscaution

All workflows declare permissions, and four are read-only; four use top-level write permissions, which is a controlled but broader automation privilege surface.