@backstage/plugin-permission-backend

Build provenancecaution

No build attestation or trusted publisher identity is present, leaving the connection between the published artifact and its source build less transparent. The active repository and extensive release history provide useful compensating evidence, but not full provenance.

Dangerous workflowscaution

Eight workflows use pull_request_target and two use untrusted checkouts, creating workflow-risk exposure, although no script-injection workflows were detected. This is a repository security concern but not enough to outweigh the project's broader controls.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention the package, so the package-to-repository relationship is less explicit. The organization-owned monorepo context makes a name mismatch ordinary, but the missing README mention remains a transparency gap.

Token permissionscaution

Eleven analyzed workflows lack top-level permissions and six grant top-level write access, which is broader than ideal for CI security. Other workflows use read-only or job-level permissions, providing partial compensation.

Version stabilitycaution

The current release is not a prerelease, but 90% of recent releases are prereleases and the package remains below a stable major version. That makes API stability less certain for dependents.