@ai-sdk/provider-utils

Licensecaution

The manifest declares Apache-2.0, while the detected artifact license is ISC; although license files exist in both the package and repository, the mismatch creates avoidable licensing ambiguity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about the package-to-repository link; the organization-backed monorepo context partly compensates for that concern.

Workflow auditcaution

All 13 workflows were analyzed and all action references are pinned, but one workflow combines a workflow_run trigger with an untrusted checkout, and high-confidence findings flag blanket GitHub App permissions and template injection; two workflows also grant top-level write access, though 11 use read-only permissions.