@sentry/bundler-plugin-core

Licensecaution

The artifact contains a license file, but the manifest declares MIT while the file is detected as BSD-3-Clause. The package is licensed, yet the mismatch reduces transparency.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so ownership of this subpackage is less transparent, although a name mismatch can be normal for a monorepo.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts or script injection, and all 39 action references are pinned. However, release.yml gives an app token blanket installation permissions; the repeated low-confidence cache findings are hygiene concerns rather than standalone severe risks.