@microsoft/applicationinsights-channel-js

Build provenancecaution

No registry build attestation or trusted-publisher identity is provided, leaving publication provenance less transparent than it could be.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the exact package, which warrants caution about package-to-repository traceability; the Microsoft Application Insights monorepo context partly explains the mismatch.

Workflow auditcaution

All seven workflows were analyzed and all action references are pinned, with no untrusted checkouts or script injection detected. High-severity cache-poisoning findings have low confidence, while high-confidence ad-hoc package installation findings are a workflow hygiene concern.