@microsoft/teams.apps

Build provenancecaution

No registry build attestation or trusted publisher identity is present, leaving the exact connection between the published artifact and source build less transparent.

Dangerous workflowscaution

One of four workflows uses pull_request_target, which warrants caution because that trigger can expose privileged automation to pull-request changes. However, the scan found no untrusted checkouts or script-injection patterns.

Token permissionscaution

Two workflows declare read-only permissions, but one workflow has top-level write permissions and another lacks top-level permissions. This is a modest least-privilege weakness, though it is not evidence of malicious behavior.