@vercel/oidc

Build provenancecaution

No build attestation is present, so consumers have less verifiable evidence connecting the published artifact to its source build, despite a GitHub trusted publisher identifier being recorded.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention @vercel/oidc, creating some uncertainty about package-to-repository mapping. The organization-backed monorepo context partly explains the name mismatch but does not remove the missing README mention.

Workflow auditcaution

All 24 workflows were analyzed, with no untrusted checkouts or script-injection findings; however, the audit found multiple high-confidence template-injection findings, 75 of 156 unpinned action references, and one failed file, so workflow hygiene is not fully clean.