@amplitude/analytics-remote-config

Release historycaution

The package has 17 releases, but none in the last 12 months; this weakens confidence in ongoing registry maintenance. Active repository work partly offsets the stale release cadence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-repository relationship is less transparent. The organization and monorepo context partly reduce this concern.

Security policycaution

No repository security policy was found, leaving a transparency gap for vulnerability reporting and response expectations.

Workflow auditcaution

All 11 workflows were analyzed and use pinned actions with no untrusted checkouts or script injection, but publish-v2.yml has two high-confidence github-app findings where an app token inherits blanket installation permissions.