@next/bundle-analyzer

Repo package mentioncaution

The linked repository is a Next.js monorepo and neither matches the package name nor mentions it in the README, which weakens package-to-repository transparency. The monorepo context partly explains the mismatch but does not remove the gap.

Workflow auditcaution

All 29 workflows were analyzed with no untrusted checkout or script-injection findings, but high-confidence secrets-inherit findings and several high-confidence template-injection findings represent workflow hygiene concerns. The two pull_request_target triggers are not dangerous on their own because the audit found no corresponding untrusted checkout or script-injection sink.