@vercel/cervel

Build provenancecaution

The release has no attestation and does not use staged publishing, leaving build origin less independently verifiable than it could be. A trusted publisher identity is present, which partly offsets the gap.

Repo issue activitycaution

The repository had 24 new issues and 24 new pull requests in the last month, but only four issues closed and no pull requests merged. The active commit and contributor signals provide stronger evidence of ongoing work.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-repository relationship is not clearly established. The mismatch may reflect a monorepo, but the absent README mention remains a transparency concern.

Version stabilitycaution

Version 0.1.82 is not a stable-major release, but it is not a prerelease and recent releases contain no prerelease versions. The main limitation is API maturity implied by the 0.x version.

Workflow auditcaution

The audit found no untrusted checkouts or script-injection sinks, but 75 of 156 action references are unpinned, one workflow could not be fully audited, and trusted publishing was flagged. High-confidence template-injection and ad-hoc-package findings are workflow hygiene concerns, while the repository's organization backing and active maintenance provide context rather than eliminating them.