@vercel/hydrogen

Build provenancecaution

No build attestation is present, so consumers have less independently verifiable publication provenance; the trusted publisher identity provides some compensating context but not an attestation.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the linkage is less transparent; the monorepo context makes a name mismatch ordinary, but the missing mention remains a caution.

Type declarationscaution

No type declarations are included, which reduces ergonomics for TypeScript consumers, but this is a consumer-experience gap rather than evidence of abandonment or unsafe maintenance.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed; 75 of 156 action references are unpinned, and high-confidence template-injection findings plus adhoc package installs remain hygiene concerns. No untrusted checkout or script-injection sink was reported, so these findings do not independently establish a severe workflow risk.