@microsoft/applicationinsights-common

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving release origin less independently verifiable. This is a transparency gap, but it is partly offset by the active organization-backed repository.

Package scaffoldingcaution

The package includes a substantial README, and the repository has tests and uses GitHub releases. However, the README explicitly says this is a deprecated compatibility layer that will be removed in version 4.0.0.

Registry deprecationcaution

The registry does not mark this package deprecated, so there is no registry withdrawal. Its published README nevertheless documents an intentional migration path and planned removal.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the exact package name, creating some uncertainty about package-to-repository linkage. The Microsoft monorepo context and package README link provide partial compensation.

Workflow auditcaution

All seven workflows were analyzed, all 18 action references are pinned, and there are no untrusted checkouts or script-injection findings. High-confidence adhoc package-install findings are a workflow hygiene concern, while the cache-poisoning findings are low confidence and do not independently outweigh the stronger controls.