@vercel/cervel

Build provenancecaution

The package has no attestation and does not use staged publishing, so release provenance is less transparent despite a trusted publisher identity being recorded.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. The monorepo structure makes a name mismatch ordinary, but the absence of a package mention leaves the package-to-repository association less transparent.

Version stabilitycaution

Version 0.1.79 is not on a stable major version, which implies API churn risk, but it is not a prerelease and recent releases show no prerelease usage.

Workflow auditcaution

All but one workflow were analyzed, but the audit found 15 high-confidence template-injection findings, 75 unpinned action uses out of 156, and numerous ad hoc package installs. No untrusted checkout or script-injection sink was found, so these are meaningful hygiene concerns rather than an automatic severe risk.