@netlify/serverless-functions-api

Build provenancecaution

No build attestation or trusted publisher identity is present, so the relationship between the source and published artifact cannot be independently verified. The package's strong release history partly offsets this transparency gap.

Lifecycle scriptscaution

The package declares prepack and prepare lifecycle scripts. These are commonly used for building published artifacts, but they add install or packaging execution surface and merit caution.

Maintainerscaution

Four of five publisher accounts use the netlify.com domain, indicating company-backed publishing, but youvalv publishes with a Gmail address. That is an account-hygiene concern rather than evidence of a thin maintenance team.