@vercel/static-build

Build provenancecaution

No build attestation is present, leaving publication provenance less verifiable even though the trusted publisher identity is GitHub.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @vercel/static-build, so the package-to-repository association is less transparent; the monorepo context partly explains the name mismatch but not the missing README mention.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed auditing; 75 of 156 action references are unpinned, and high-confidence template-injection findings plus ad hoc package installs indicate workflow hygiene gaps. The workflow_run trigger is in a different path from the reported template-injection findings, so this is caution rather than a standalone severe risk.