@microsoft/applicationinsights-properties-js

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits publication transparency but does not outweigh the package's strong release and repository activity.

Repo bus factorcaution

One contributor made 10 of 12 recent commits, or 83.3%, while two others made one each. This concentration is a caution, though Microsoft organization backing provides some capacity for handoff.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. A name mismatch is normal for a monorepo, but the absence of a README mention leaves some uncertainty that this repository is the package's source.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts or script injection, and all 18 action references are pinned. High-confidence findings report ad hoc package installation, while low-confidence cache-poisoning findings and top-level write permissions indicate workflow hygiene gaps rather than a severe risk.