@vercel/gatsby-plugin-vercel-builder

Build provenancecaution

No build attestation is present, so published-build traceability is limited. The trusted publisher ID is GitHub, which provides some publishing context but does not replace an attestation.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package. This is plausible for a monorepo subpackage, but the missing explicit mention leaves package-to-repository linkage less transparent.

Type declarationscaution

No type declarations are published. This is a modest consumer-ergonomics gap for a Gatsby plugin, but it does not indicate abandonment or unclear ownership.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed and 75 of 156 action references are unpinned. High-confidence template-injection findings and broad workflow hygiene issues merit caution, although no untrusted checkout or script-injection sink was found.