@amplitude/analytics-connector

Lifecycle scriptscaution

A prepublish lifecycle script is present; this is not inherently unsafe for consumers because it is generally a publish-time hook, but it adds build-pipeline complexity and warrants review.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating a transparency concern that the linked repository may not directly correspond to this release; organization ownership partially mitigates, but does not remove, the mismatch.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and disclosure expectations less transparent despite the presence of Semgrep scanning.

Token permissionscaution

All 7 workflows lack top-level token permissions declarations, and none declare read-only permissions; although no workflow has top-level write permissions and two use job-level permissions, least-privilege configuration is not consistently explicit.