@amplitude/plugin-event-property-attribution-browser

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the link is less transparent; the organization-backed monorepo context partly explains why a subpackage may not match the repository name.

Security policycaution

No repository security policy was found. This is a transparency gap for a maintained SDK, though active development and Semgrep scanning provide partial compensating evidence.

Version stabilitycaution

The release is not a prerelease, although it remains on a pre-1.0 major version and 25% of recent releases were prereleases. This is a modest maturity concern rather than a release blocker.

Workflow auditcaution

All 11 workflows were analyzed, all 64 action references are pinned, and no untrusted checkout or script-injection paths were found. However, three high-confidence findings in the publishing workflow report an app token inheriting blanket installation permissions, creating a meaningful credential-scope concern.