proto3-json-serializer

Repo package mentiondanger

The linked repository is googleapis/google-cloud-node, but its name does not match the package and its README does not mention proto3-json-serializer. This creates a meaningful concern that the source mapping is incorrect.

Lifecycle scriptscaution

The package has a prepare install-time lifecycle script. This is common for packages that build during publication, but it adds execution during installation and warrants attention.

Workflow auditcaution

All 75 analyzed action references are pinned, 17 workflows use read-only permissions, and no untrusted checkout or script-injection sink was found. The audit was incomplete for 1 of 19 workflows and found two high-confidence low-severity adhoc package installations, so only a minor hygiene concern remains.