parse-server

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less verifiable. The strong repository and release activity partly compensate, but do not remove the gap.

Lifecycle scriptscaution

The package runs postinstall and prepare scripts, which add install-time behavior that consumers should understand. No provided signal shows those scripts are unsafe, so this is a limited transparency concern.

Workflow auditcaution

All seven workflows were analyzed and none uses untrusted checkout or risky pull-request triggers, but all 72 action references are unpinned and high-confidence template-injection and unpinned-image findings remain. The low-confidence cache findings are hygiene concerns rather than decisive risks.