aws-xray-sdk-core

Build provenancecaution

No build attestation or trusted publisher provenance is provided for the release. The source repository has build tooling and an established release workflow, but that does not verify how this exact artifact was produced.

Lifecycle scriptscaution

A prepare install lifecycle script is present, which adds execution during installation and warrants some review. The signal does not show that the script is dangerous, so this is a limited supply-chain hygiene concern rather than a severe risk.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. Although the package has recent releases and the repository was pushed recently, the absence of recent commit activity is a meaningful maintenance concern.

Repo issue activitycaution

There were no new or closed issues and no new or merged pull requests in the last month, while 105 issues and 22 pull requests remain open. This indicates weak recent issue-handling activity and lowers confidence in responsiveness.

Token permissionscaution

Most workflows declare read-only or job-level permissions, but one workflow lacks top-level permissions and three workflows request top-level write access. This is a workflow hardening gap, though it is not evidence of malicious behavior.