@vercel/koa
82%
Total Score
healthy
Frequent releases and strong repository activity outweigh workflow and package-identification gaps.
Health Score Breakdown
No build attestation or staged publishing is reported, leaving provenance transparency weaker than it could be. The trusted publisher is identified as GitHub, which partly offsets that gap.
The repository name does not match @vercel/koa and its README does not mention the package. A monorepo name mismatch is normal, but the absence of both an exact match and README mention creates some uncertainty about package ownership.
No type declarations are published, which is a consumer ergonomics gap for TypeScript users, but it does not indicate abandonment or weak project maintenance.
All 24 workflows were analyzed, but one file failed and the audit reports 15 high-confidence template-injection findings plus many unpinned action references and ad hoc package installs. No untrusted checkout or script-injection sink was found, so these are workflow-hygiene concerns rather than a standalone severe risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @vercel/node Version 24.0.3 | — | — |
@vercel/static-config Version 3.4.4 | — | — |
Weekly Downloads
Info
- Last Published
- 47 minutes ago
- Created
- 9 months ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.