@firebase/performance-types

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which is a transparency caution; the organization-owned Firebase monorepo context partly explains the mismatch.

Version stabilitycaution

Version 0.2.5 is not a prerelease, but 90% of recent releases are prereleases, which makes the release stream less predictable.

Workflow auditcaution

All 21 workflows were analyzed with no untrusted checkout or script-injection paths, all 106 action references were pinned, and permissions were mostly read-only. The audit still found a high-confidence low-severity ad hoc package install and a low-confidence cache-poisoning pattern, warranting limited caution.