@neondatabase/serverless

Build provenancecaution

No build attestation or staged publishing is present, leaving less verifiable evidence about how the artifact was produced. This is a transparency gap, not evidence that the release is unsafe.

Maintainerscaution

The package has six publishing accounts and clear Neon organization backing, but consumer accounts amitdahan (gmail.com) and pffigueiredo (gmail.com), plus outside-domain accounts jawj (mackerron.co.uk) and atilaz (fassina.eu), create some account-hygiene risk alongside the neon.tech accounts.

Repo toolingcaution

The repository uses TypeScript, Vite, npm scripts, and esbuild, but no security-scanning tools were detected. The build setup is established, while security automation is a maintenance gap.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear for a database connectivity package.

Workflow auditcaution

All three workflows were analyzed successfully; all 20 action references are pinned and no audit findings or untrusted checkout or script-injection paths were found. Two workflows grant top-level write permissions, which is a mild least-privilege concern without an untrusted trigger.