@sentry/webpack-plugin

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, which leaves publication origin less transparent, although the package has substantial independent maintenance evidence.

Licensecaution

The artifact and repository both contain license files, but the manifest declares MIT while the detected artifact license is BSD-3-Clause; that mismatch warrants clarification despite the package being licensed.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts or script injection, and all 39 action references are pinned. However, release.yml has a high-confidence finding that an app token inherits blanket installation permissions; the many low-confidence cache findings are hygiene concerns only.