72%
Total Score
caution
Strong maintenance and organization backing offset missing declarations, repository mismatch, and workflow hygiene concerns.
No build attestation or staged publishing is present, leaving release provenance less verifiable despite the trusted publisher identity being GitHub.
The artifact contains only LICENSE, dist/index.js, and package.json, making it less transparent to inspect, though the large source repository and compiled-package layout partly compensate.
The repository had 26 new issues and 25 new pull requests in one month, but no merged pull requests were recorded; this is a minor activity concern offset by its commit activity.
The repository name does not match the package and its README does not mention @vercel/nestjs, creating uncertainty that this monorepo is the package's direct source.
No type declarations are published, which creates a real integration gap for a package likely to be consumed from TypeScript.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@vercel/node Version 24.0.1 | — | — |
@vercel/static-config Version 3.4.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.