@sentry/profiling-node

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the package's active release and repository history.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which weakens direct package-to-repository transparency; the organization-owned monorepo context partly offsets that concern.

Workflow auditcaution

All 27 workflows were analyzed with no failed files and no untrusted checkouts or script injections, but 145 of 164 action references are unpinned and high-confidence github-app findings report blanket installation permissions. The many low-confidence cache findings are hygiene concerns rather than decisive evidence.