@vercel/functions

Build provenancecaution

The package has no attestation, so the registry cannot provide additional build-origin evidence. This is a transparency limitation, but it is outweighed by the active, organization-backed project evidence.

Repo package mentioncaution

The repository name does not match @vercel/functions and its README does not mention the package. A name mismatch is normal for a monorepo, but the absence of a README mention leaves package ownership less explicit.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed review. The audit found high-confidence template-injection patterns and many unpinned action uses; no untrusted checkouts or script-injection findings were reported, and the template findings were not shown to share a dangerous trigger.