@vercel/node

Build provenancecaution

No build attestation or staged publishing is reported, although the trusted publisher identity is GitHub; the missing verifiable provenance is a supply-chain transparency gap.

Dependency profilecaution

The package declares 21 runtime dependencies, including substantial runtime and build-related components; this adds maintenance surface but is consistent with a server runtime package.

Workflow auditcaution

All 24 workflows were analyzed, with no untrusted checkout or script-injection findings. However, the audit reports high-confidence template-injection findings, repeated ad hoc package installs, 75 of 156 unpinned action uses, and one failed file; these are workflow hygiene and reproducibility concerns, not evidence of an immediate dependency risk.