firebase-admin

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the registry artifact's build path less independently verifiable. The mature repository and release history partly compensate, but do not remove this transparency gap.

Lifecycle scriptscaution

The package has a prepare install-time script. This is a review point because it runs during installation, but the supplied signals do not show that it is unsafe or unusually broad.

Workflow auditcaution

All three workflows were analyzed, use read-only permissions, and pin all 13 action references, with no untrusted checkouts or script injection. Two high-confidence low-severity adhoc-package findings are minor hygiene concerns because workflows install packages outside a lockfile.