@vercel/gatsby-plugin-vercel-analytics

Build provenancecaution

The package has no build attestation, so publication cannot be independently verified from the provided provenance data. The trusted publisher is identified as GitHub, which partly offsets this transparency gap.

Repo issue activitycaution

The repository remains active, with 20 new issues and 39 new pull requests in the last month, although only 3 issues and 2 pull requests were closed or merged. The workload is a mild maintenance concern but not abandonment evidence.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, so the source-package relationship is not established by this signal. Organizational ownership and the package README provide context but do not remove that uncertainty.

Type declarationscaution

The package provides no type declarations. That is a minor integration gap for a Gatsby plugin, but it does not by itself indicate abandonment or unsafe maintenance.

Workflow auditcaution

All but one workflow was analyzed, but one file failed audit. High-confidence template-injection findings and numerous ad hoc package installs warrant workflow hygiene caution; no untrusted checkout or script-injection sink was found, and only 75 of 156 action uses were unpinned.