@microsoft/applicationinsights-web-snippet

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable. This is a transparency gap, but the active organization-owned repository and other project evidence partly compensate.

Repo bus factorcaution

One contributor made about 84% of the 19 recent commits, creating concentrated maintenance risk. The Microsoft organization provides some handoff capacity, and two additional contributors remained active.

Workflow auditcaution

All seven workflows were analyzed, action references are fully pinned, and no untrusted checkout or script-injection paths were found. However, five workflows grant top-level write permissions and several high-confidence findings report packages installed outside lockfiles; the low-confidence cache findings are hygiene concerns only.