@sentry/cli-win32-arm64

Build provenancecaution

No build attestation or trusted-publisher identity is available, leaving release provenance less transparent. The active organization-backed repository and release process provide some compensating context but do not replace attestation.

Repo package mentioncaution

The repository name differs from the platform-specific package name, which is normal for a subpackage, but its README does not mention this package. That weakens direct package-to-repository transparency slightly.

Token permissionscaution

Ten workflows lack top-level permissions declarations, and three declare top-level write access; although no dangerous workflow pattern was detected, least-privilege configuration is not consistently evident.