@snowplow/tracker-core

Build provenancecaution

No build provenance attestation or trusted publisher identity is present, leaving publication-to-source verification weaker than it could be.

Repo issue activitycaution

The repository has 94 open issues and no issues closed in the last month, which is a modest process concern, but six pull requests were merged during that month and the package has continued releasing.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package name, which creates a package-to-repository transparency concern. The package README nevertheless explicitly identifies tracker-core as part of this Snowplow JavaScript Tracker monorepo, partially explaining the mismatch but not eliminating the signal gap.

Repo toolingcaution

TypeScript build tooling is used, but no security scanning tools were detected; this is a transparency and preventive-hygiene gap rather than evidence of unsafe behavior.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and security-maintenance expectations undocumented.