@sentry/bundler-plugins

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving the connection between source and published artifact less independently verifiable.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty that the linked monorepo directly represents this artifact.

Workflow auditcaution

All 27 workflows were analyzed, with no untrusted checkouts or script-injection findings. However, 145 of 159 action references are unpinned, several workflows grant broad app-token permissions, and one archived action was detected; the low-confidence cache findings are hygiene concerns only.