@amplitude/plugin-web-vitals-browser

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which is a transparency gap; the matching Amplitude organization and large monorepo file tree partly explain the mismatch.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less transparent despite the presence of security scanning.

Version stabilitycaution

Version 1.2.5 is a stable major release and is not a prerelease, although the README still describes the plugin as beta, so interface change remains a minor adoption concern.

Workflow auditcaution

All 11 workflows were analyzed, all 64 action references are pinned, and there are no untrusted checkouts or script injections. However, three high-confidence findings report GitHub app tokens inheriting blanket installation permissions, creating a contained workflow-permission concern.