@amplitude/plugin-autocapture-browser

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which creates some provenance ambiguity; the mismatch is also consistent with this package being a sub-package of a monorepo.

Security policycaution

No repository security policy was found, leaving disclosure and response guidance unclear for a browser-facing package.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkouts, script injection, or unpinned actions, but publish-v2.yml has three high-confidence findings where an app token inherits blanket installation permissions. That is a meaningful supply-chain hygiene concern even without an untrusted trigger.