@vercel/hydrogen

Build provenancecaution

No build attestation is available, so the release has less publication transparency than an attested build. The trusted publisher identity provides some compensating context but does not replace an attestation.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @vercel/hydrogen. Although monorepo subpackages can legitimately use a shared repository, this leaves package-to-source ownership less transparent.

Type declarationscaution

No type declarations are included. This creates integration friction for consumers, although the small compiled artifact limits the scope of the gap.

Workflow auditcaution

All 24 workflows were analyzed, with no untrusted checkouts or script-injection findings. However, 75 of 156 action references are unpinned, one file failed analysis, and the audit reports high-confidence template-injection findings plus ad hoc package installation; these are workflow hygiene concerns, not evidence that the package itself is unsafe.