@microsoft/applicationinsights-dependencies-js

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving publication origin less independently verifiable than it could be. This is a transparency gap, not evidence that the release is unsafe.

Workflow auditcaution

All seven workflows were analyzed, all 18 action references are pinned, and no untrusted checkout or script-injection paths were found. However, five workflows use top-level write permissions and high-severity cache-poisoning findings have low confidence, while high-confidence adhoc-package findings show installs outside a lockfile; together these are workflow hygiene cautions rather than a severe dependency risk.