@vercel/gatsby-plugin-vercel-builder

Build provenancecaution

No build attestation is present, so consumers have less independently verifiable evidence connecting the published artifact to its source build.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention the package, leaving some uncertainty about the exact source mapping. The organization-owned monorepo context partly compensates for this mismatch.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed audit, 75 of 156 action references are unpinned, and high-confidence template-injection findings plus adhoc package installs remain. The workflow_run trigger has no untrusted checkout or script-injection count, so these are hygiene concerns rather than standalone severe risk.