@vercel/fastify

Build provenancecaution

No build attestation or staged publishing evidence was found, leaving release provenance less transparent despite the trusted publisher identity being GitHub.

Repo package mentioncaution

The repository name does not match @vercel/fastify and its README does not mention the package, so the linkage is less transparent even though the repository is owned by the matching Vercel organization.

Type declarationscaution

No type declarations are included, which reduces TypeScript ergonomics for consumers of this library. This is a consumer-experience gap rather than evidence of abandonment.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed audit; 75 of 156 action references are unpinned, and high-confidence template-injection findings plus repeated ad hoc package installs create workflow hygiene concerns. No untrusted checkout or script-injection sink was observed.