firebase-tools

Build provenancecaution

No build attestation or trusted-publisher identity was recorded, leaving publication provenance less transparent than it could be, although this is not evidence of a bad release by itself.

Maintainerscaution

Three of four publishing accounts use the Google domain, consistent with the organization-backed repository; feiyang.chen uses a Gmail account, which is a modest account-hygiene concern rather than evidence of limited maintenance capacity.

Workflow auditcaution

All three workflows were analyzed with no high- or medium-severity findings, no untrusted checkouts, and all 29 action references pinned; one workflow has broad write permissions and high-confidence low-severity adhoc-package findings, so this is a minor hygiene concern.