@firebase/analytics

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is reported, leaving release-to-source provenance less transparent.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention the package, creating a package-to-repository traceability concern; the organization-backed monorepo context partly compensates but does not eliminate it.

Repo toolingcaution

The repository uses established build tools including Nx, Rollup, Webpack, TypeScript, and Babel, but no security-scanning tools were detected, leaving a modest tooling gap.

Token permissionscaution

Sixteen workflows declare read-only permissions and none declare top-level write permissions, although five lack top-level permissions declarations and five rely on job-level permissions only.

Version stabilitycaution

The current release is not a prerelease, but it remains on a 0.x major version and 75% of recent releases are prereleases, so API stability may require care despite the active release cadence.