We need to easily see how the SDK was installed. For example, did a JavaScript browser event come from the CDN, npm or the loader? Did an iOS event come from carthage, spm or cocaopods?

We first decided to make source a new top level field in the event payload sdk interface, but ended up reverting this decision in getsentry/develop#819.

#43427 (comment)

Now we're going to take advantage of the packages field in the SDK interface instead.

A list of packages that were installed as part of this SDK or the activated integrations. Each package consists of a name in the format source:identifier and version. If the source is a Git repository, the source should be git, the identifier should be a checkout link and the version should be a Git reference (branch, tag or SHA).

Here then we can update the source to accomplish this.

#43427 (comment)