gcp-metadata

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, reducing release transparency. This is a provenance gap, not evidence that the release is unsafe.

Lifecycle scriptscaution

The package defines a prepare install-time script. This is a mild supply-chain and installation-complexity consideration, although no dangerous behavior is shown by this signal alone.

Maintainerscaution

Two of three publishing accounts use the google.com domain, consistent with the organization-owned repository. stephenplusplus (gmail.com) is an outside publishing account, creating a minor account-hygiene concern rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name differs from gcp-metadata and its README does not mention the package, which weakens direct package-to-source traceability. The organization-owned monorepo context partly explains the name mismatch but does not remove the missing mention.

Workflow auditcaution

All 71 analyzed action references are pinned, 17 workflows use read-only permissions, and there are no high- or medium-severity findings. The audit is incomplete because one of 19 workflows failed analysis, and two high-confidence low-severity findings install packages outside a lockfile, so this is a minor hygiene concern.