@vercel/h3

Build provenancecaution

No build attestation is provided, leaving publication provenance less transparent, though the trusted publisher identity is GitHub.

Package file treecaution

The artifact contains only LICENSE, dist/index.js, and package.json, making it minimal for consumers; the much larger repository provides the project context and development materials.

Type declarationscaution

The package exposes no type declarations, which is a real integration drawback for consumers using typed tooling, although it does not by itself indicate abandonment.

Workflow auditcaution

All 24 workflows were analyzed and no untrusted checkout or script-injection sink was found, but 75 of 156 actions are unpinned and the audit reports high-confidence template-injection findings plus ad hoc package installs; trusted publishing is also not used. These are workflow hygiene concerns, not evidence that the release itself is unfit.