@ai-sdk/vercel
5
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
vercel-release-botmatheussmatt.straka
Keywords
ai
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from vercel-release-bot to GitHub Actions is a CI pipeline migration within Vercel's own infrastructure; SLSA attestation confirms legitimate origin. | ai | |
| typosquat | typosquat.levenshtein:parcel | AI (typosquat): @ai-sdk/vercel is named after Vercel the company (the publisher), not a typo of 'parcel'. Official package from vercel-release-bot under the @ai-sdk/ namespace. | ai | |
| provenance | no-provenance | AI (provenance): Legitimate Vercel release bot package; lack of Sigstore provenance is a known gap for this publisher, not a security concern. | ai |