@types/cookie-parser

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, leaving publication origin less verifiable. This is a transparency limitation, not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package, creating a small ownership-transparency concern. The package README identifies the corresponding DefinitelyTyped path, which partly offsets that concern for this monorepo subpackage.

Workflow auditcaution

All seven workflows were analyzed, all 25 action references are pinned, and no untrusted checkout or script-injection paths were found. Four medium-confidence template-injection findings remain as workflow hygiene concerns.