@sentry/node-core

Package scaffoldingdanger

The published README explicitly labels @sentry/node-core deprecated and says it will be removed in the next major version, directing users toward functionality merged into @sentry/node. The package does include a substantial README and the repository has tests and a changelog, but those strengths do not remove the migration risk.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @sentry/node-core. The organization-backed monorepo makes a name mismatch ordinary, but the missing package mention leaves some uncertainty about the exact package-to-source relationship.

Workflow auditcaution

The audit analyzed all 26 workflows and found no untrusted checkouts or script-injection paths, but 145 of 164 action references are unpinned and several workflows expose broad app-token permissions. These are meaningful workflow hygiene concerns, though they are not by themselves evidence that the package is malicious.