@vercel/express

Latest 18.0.1

NPM

78%

Total Score

healthy

Active project backing and release cadence offset missing consumer documentation, types, and workflow hygiene concerns.

Health Score Breakdown

Build provenance

The release has no attestation, which limits publication transparency, although the trusted publisher identity is GitHub and no staged-publishing concern is reported.

Repo issue activity

The repository saw 26 new issues and 26 new pull requests in the last month, but no pull requests were merged in that period; other activity signals show the project remains active.

Repo package mention

The repository name does not match the package and its README does not mention the package, leaving some uncertainty about package-specific ownership; the organization-owned monorepo context partly compensates.

Type declarations

No type declarations are included, which reduces usability and type safety for consumers of this JavaScript library.

Workflow audit

All 24 workflows were analyzed, but one file failed auditing, 75 of 156 action references are unpinned, and high-confidence template-injection findings remain; no untrusted checkout or script-injection sink was found alongside those triggers.