@firebase/performance

Build provenancecaution

No registry build attestation or trusted-publisher provenance was provided, leaving publication origin less independently verifiable despite the active organization-backed project.

Repo package mentioncaution

The repository name and README do not explicitly mention this package, which creates a package-identity transparency concern; its organization-owned Firebase monorepo context partly explains the mismatch but does not remove it.

Repo toolingcaution

The repository uses established build tools and TypeScript, but no security-scanning tooling was detected, leaving a modest security-process gap.

Version stabilitycaution

The current release is not a stable major version and 80% of recent releases are prereleases, which adds some maturity uncertainty despite the active release cadence.

Workflow auditcaution

All 21 workflows were analyzed, all 106 action references are pinned, and permissions are read-only or job-scoped. The audit found a high-severity cache-poisoning pattern only at low confidence and a high-confidence low-severity ad hoc package install, so this is a minor hygiene concern rather than a severe dependency risk.