google-logging-utils

Lifecycle scriptscaution

A prepare install-time script is present, adding execution during installation, although the package has no runtime dependencies and the provided evidence does not show harmful behavior.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which raises a package-to-source mapping concern; the repository's monorepo structure makes a name mismatch alone ordinary, but the lack of a README mention remains cautionary.

Workflow auditcaution

All 75 analyzed action references are pinned and 17 workflows use read-only permissions, but one of 19 workflows could not be analyzed and two high-confidence findings report packages installed outside a lockfile; one pull_request_target workflow also has top-level write permissions without an identified untrusted sink.