@vercel/static-config

Build provenancecaution

No build attestation or staged publishing is present, leaving release origin less independently verifiable despite the active project evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-repository relationship is not clearly demonstrated even though the repository is organization-backed.

Workflow auditcaution

All 24 workflows were analyzed, but one file failed audit; 75 of 156 action references are unpinned, and the audit reports high-confidence template-injection findings plus ad hoc package installs. The findings are workflow hygiene concerns rather than a standalone health verdict, but the incomplete audit prevents a clean result.