gcp-metadata

Build provenancecaution

No build attestation or trusted-publisher identity is present, so consumers have less independently verifiable evidence connecting the artifact to its source build.

Lifecycle scriptscaution

A prepare install-time script runs during installation, adding build-time behavior that consumers should account for, although this alone is not evidence of unsafe behavior.

Maintainerscaution

Two of three publish accounts use the Google domain, consistent with the organization-backed repository. The stephenplusplus Gmail publishing account is an account-hygiene caution, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match gcp-metadata and its README does not mention the package, so the linkage is less transparent than expected and could indicate a package-to-monorepo mapping gap.

Workflow auditcaution

All 71 analyzed action references are pinned, 17 workflows use read-only permissions, and there are no high- or medium-severity findings. The audit is incomplete because 1 of 19 workflows failed analysis, and two high-confidence low-severity findings install packages outside a lockfile; one workflow also has top-level write permissions.