gaxios

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent. This is a supply-chain transparency gap, though the active organization-backed project provides compensating maintenance evidence.

Lifecycle scriptscaution

The package has a prepare lifecycle script, which adds install-time behavior and merits awareness, but this signal alone does not show unsafe or excessive installation activity.

Repo package mentioncaution

The linked repository name does not match gaxios and its README does not mention gaxios. Although a monorepo mismatch can be normal, the absence of any package mention leaves the package-to-source relationship less transparent.

Workflow auditcaution

All 71 analyzed action references are pinned, and 17 workflows use read-only permissions. The audit is incomplete because one of 19 workflows failed analysis, and two high-confidence low-severity adhoc-package findings show packages installed outside lockfiles; the pull_request_target workflow has broad write permissions but no detected untrusted checkout or script injection.