@unit-finance/unit-node-sdk

Build provenancecaution

No build attestation or trusted publisher information is provided. The repository has a build and publish workflow, but the published artifact cannot be independently tied to that source by the collected provenance evidence.

Lifecycle scriptscaution

The package uses a prepare install lifecycle script. This is an additional install-time execution surface, though the available evidence does not show that it is dangerous.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security-scanning tools were detected. The build setup is present; the missing security tooling is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no SECURITY.md or other collected security policy. This leaves vulnerability reporting and response expectations undocumented.

Token permissionscaution

Neither workflow declares top-level token permissions. Although no workflow requests top-level write access, explicit least-privilege permissions would provide stronger workflow hardening.