@firebase/analytics-types

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which weakens direct linkage evidence. The package's scoped name and type-only role make monorepo placement plausible, so this is a caution rather than a severe concern.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, and permissions are read-only or job-scoped. The audit also found a high-severity but low-confidence cache-poisoning pattern and a high-confidence adhoc package installation, creating a minor workflow-hygiene concern.