@azure/monitor-opentelemetry-exporter

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. The strong release and repository activity partly offsets this transparency gap.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, creating uncertainty about the exact package-to-repository mapping. The organization-owned monorepo context makes a name mismatch ordinary, but the missing README mention remains a caution.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts for builds. No security-scanning tooling was detected, which is a modest repository hygiene gap.

Version stabilitycaution

The assessed version is a prerelease, and all recent versions are prereleases, so consumers should expect API or behavior changes despite the stable major number.

Workflow auditcaution

All 23 workflows were analyzed, with no untrusted checkouts or script-injection findings; most workflows use read-only or job-level permissions. High-confidence template-injection findings and two high-confidence ad hoc package installs remain workflow hygiene concerns, while the low-confidence environment findings carry limited weight.