@backstage/plugin-catalog-backend

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving artifact provenance less transparent even though the project has strong repository and maintenance evidence.

Dangerous workflowscaution

The repository includes 8 pull_request_target workflows, 2 workflows with untrusted checkouts, and 2 workflow_run workflows. No script-injection workflows were found, but the privileged workflow patterns warrant review.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this exact package, creating an association gap. The package is part of an organization-owned monorepo, which makes the name mismatch ordinary but does not remove the missing README reference.

Token permissionscaution

Of 30 analyzed workflows, 11 lack top-level permissions and 6 declare top-level write access. Although 13 use read-only permissions, the inconsistent permission posture is a genuine CI hygiene concern.