@vercel/python-analysis

Build provenancecaution

No build attestation is published, leaving the artifact's build origin less independently verifiable despite trusted-publisher metadata identifying GitHub.

Repo package mentioncaution

The repository name differs from the package and its README does not mention the package, creating some uncertainty about package-specific ownership even though the package sits in the matching organization namespace.

Version stabilitycaution

Version 0.14.0 is not a stable major release, so the API may still change, but it is not a prerelease and recent prereleases represent only 5% of releases.

Workflow auditcaution

All 24 workflows were analyzed, but 75 of 156 action references are unpinned and high-confidence template-injection findings appear in several workflows; no untrusted checkout or script-injection sink was found, so this is a hygiene caution rather than a severe verdict.