@vercel/cli-auth

Build provenancecaution

The release has no attestation, so consumers receive less verifiable build-origin information, although it uses GitHub as the trusted publisher and staged publishing is not enabled.

Repo issue activitycaution

The repository has substantial current pull-request and issue activity, though only 1 of 33 new pull requests was merged in the last month, which suggests some backlog.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @vercel/cli-auth, creating uncertainty about package-specific documentation. The organization-owned monorepo context partly explains the mismatch but does not remove it.

Version stabilitycaution

Version 0.3.10 is not yet at a stable major version, which leaves compatibility expectations less mature, although it is a regular release rather than a prerelease.

Workflow auditcaution

All 24 workflows were analyzed, but 75 of 156 action references are unpinned, 15 high-confidence template-injection findings were reported, and many workflows install packages outside lockfiles. No untrusted checkout or script-injection sink was found, so this is workflow hygiene risk rather than a standalone severe dependency-health failure.