@apm-js-collab/tracing-hooks

Repo bus factorcaution

Four contributors are active, but one accounts for about 71% of recent commits; the organization-owned project provides some ability to hand maintenance off, so this is only a mild concern.

Repo toolingcaution

No build tool or security-scanning tool was detected. This is a transparency and assurance gap, though active tests and repository development partly compensate.

Security policycaution

The repository has no security policy, making vulnerability reporting and response expectations less transparent.

Version stabilitycaution

Version 0.13.3 is not a stable major release, which signals pre-1.0 API maturity risk, although it is not a prerelease and recent versions are stable.

Workflow auditcaution

Both workflows were analyzed without high- or medium-severity findings, but all six action references are unpinned, one workflow has top-level write permissions, and a high-confidence audit found an ad hoc package install.