@datadog/js-core

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, but it is moderated by the active organization-owned repository and the otherwise complete artifact.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @datadog/js-core, creating some package-to-repository traceability concern. The package tree does contain matching source and built modules, which partially compensates for the monorepo naming mismatch.

Security policycaution

The linked repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting expectations unclear.

Version stabilitycaution

Version 0.0.17 is not a stable major release, so APIs may change; it is nevertheless a normal release rather than a prerelease and has no recent prerelease share.

Workflow auditcaution

All six workflows were analyzed and all 15 action references are pinned, with no untrusted checkout or script-injection findings. One high-severity cache-poisoning finding has low confidence and is hygiene at most, while a high-confidence archived action and several top-level write permissions warrant caution; no untrusted sink reaches those permissions.