@vercel/ruby

Build provenancecaution

No build attestation is present, leaving provenance transparency weaker than it could be; the trusted publisher is GitHub, which provides some publishing context but not an attestation.

Repo issue activitycaution

The repository saw 25 new issues and 25 new pull requests in the last month, with five issues closed; activity is evident, although no pull requests were merged in that period.

Repo package mentioncaution

The repository name does not match @vercel/ruby and its README does not mention the package, so the package-to-source relationship is less transparent; this may be normal for a monorepo sub-package but remains a caution.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed audit. High-confidence template-injection findings and 75 unpinned action references create workflow hygiene concerns; no untrusted checkout or script-injection sink was found, so this is not a standalone severe risk.