@snowplow/browser-tracker-core

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing evidence is present, leaving the relationship between source and artifact less verifiable.

Repo issue activitycaution

Recent activity includes six merged pull requests in one month, although 94 open issues and no newly closed issues in that month indicate some backlog.

Repo toolingcaution

TypeScript build tooling is present, supporting a defined build process, but no repository security-scanning tools were detected.

Security policycaution

The linked repository has no SECURITY.md or equivalent security policy, which weakens vulnerability-reporting transparency.

Token permissionscaution

Five workflows lack top-level permissions declarations and two declare top-level write access, indicating avoidable CI token-scope ambiguity.