@sentry-internal/node-cpu-profiler

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving publication provenance less transparent despite the otherwise active project evidence.

Lifecycle scriptscaution

An install lifecycle script is expected for a package that distributes and prepares native binaries, but it adds install-time execution and therefore modest dependency risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so ownership of this artifact is less transparent even though the organization-backed repository is related in purpose.

Workflow auditcaution

The workflows were fully analyzed and all action references are pinned, with no untrusted checkout or script-injection paths. However, the release workflow has a high-confidence finding that an app token inherits blanket installation permissions, while low-confidence cache warnings and high-confidence ad hoc package installs add workflow hygiene concerns.