@envelop/instrumentation

Release historycaution

The package has five releases over about 18 months and a release within minutes of collection, though only one release occurred in the last 12 months; this is acceptable for a small utility but suggests a modest release cadence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-source relationship is not transparent. The organization-owned repository and monorepo context partly compensate, but the missing explicit reference remains a caution.

Security policycaution

No security policy was found in the repository, leaving vulnerability reporting and response expectations less transparent.

Token permissionscaution

Five of six workflows do not declare top-level token permissions, and the release workflow has top-level write access; this is a workflow-hardening gap, though no dangerous workflow pattern was detected.