@azure/core-tracing

Build provenancecaution

No build attestation or trusted-publisher identity was recorded. This limits publication transparency, but the package still has consistent licensing, a stable release, and an active organization-backed source project.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @azure/core-tracing. A monorepo mismatch is ordinary, but the absence of a package reference leaves package-to-source linkage less transparent.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts for builds, supporting a structured build process. No security scanning tools were detected, leaving a modest transparency gap.

Workflow auditcaution

All 21 workflows were analyzed, with no untrusted checkouts or script-injection findings; however, high-confidence template-injection findings overlap with pull_request_target workflows, one workflow grants top-level write access, and two install packages outside a lockfile. These are workflow-hygiene concerns rather than evidence that the release is unsafe by itself.