google-gax

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing publication transparency, although the package has a long release history and active repository maintenance to compensate.

Lifecycle scriptscaution

The package has a prepare install lifecycle script, which adds execution during installation and modestly increases dependency-installation risk.

Maintainerscaution

Two of three publish-access accounts use the google.com domain, consistent with organization backing. The outside-domain account mrdoob (mrdoob.com) is an account-hygiene caution, not evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match google-gax and its README does not mention the package, so the package-to-repository mapping is less transparent. The mismatch may reflect a monorepo, but the collected evidence does not confirm that.

Workflow auditcaution

All 71 analyzed action references are pinned and 17 workflows use read-only permissions, with no untrusted checkout or script-injection findings. The audit missed one of 19 workflows and found two high-confidence low-severity adhoc package installations, so workflow hygiene is not fully clean.