@docusaurus/plugin-google-tag-manager

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which weakens package-to-repository traceability. The package is a Docusaurus monorepo subpackage, so the name mismatch itself is ordinary, but the missing README mention remains a minor transparency gap.

Workflow auditcaution

All 17 workflows were analyzed successfully, all 76 action references are pinned, and no untrusted checkout or script-injection sink was found. High-confidence template-injection findings and trusted-publishing usage remain workflow hygiene concerns, while the low-confidence-independent package-install findings are limited concerns.