@amplitude/analytics-core

Repo package mentioncaution

The linked repository is a monorepo whose name does not match this sub-package, which is ordinary, but its README also does not mention the package, leaving package ownership and source mapping less explicit.

Security policycaution

No repository security policy was found, which is a transparency gap for reporting vulnerabilities, although active development and security scanning partly compensate.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkout, script injection, or unpinned action findings, but three high-confidence findings report blanket app-token permissions in the publish-v2 workflow. This is a meaningful release-workflow exposure even without an identified untrusted trigger.