angular-auth-oidc-client

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving the registry artifact's build origin less transparent despite the healthy source repository.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected; for an authentication library, that is a modest transparency gap.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts or script injection, but all 14 action references are unpinned and the build makes three high-confidence ad hoc package installs outside a lockfile. These are workflow hygiene concerns rather than severe findings because no untrusted trigger or write-wide token was observed.