@posthog/core

Licensecaution

The package declares MIT and includes a license file, while the artifact also contains Apache-2.0 text; the differing detected license is a minor transparency mismatch, not an absence of licensing.

Maintainerscaution

The package is backed by the PostHog organization and has 21 registry publishers, but several publish through consumer email accounts, including fuziontech, mariusandra, and robbie-c; this is account hygiene caution rather than evidence of limited maintenance capacity.

Repo package mentioncaution

The repository name does not match @posthog/core and its README does not mention the package, so the package-to-repository linkage is less transparent; this may be ordinary for a monorepo but remains a caution.

Workflow auditcaution

All 30 workflows were analyzed, all use read-only permissions, and all 210 action references are pinned with no untrusted checkout or script-injection paths. The audit still found high-confidence bot-condition, template-injection, and broad GitHub App token issues, plus high-confidence ad hoc package installs, warranting workflow hygiene caution.