npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of vercel, generated . This is a read-only snapshot.
Run your own audit →

Audit of vercel

Re-run this audit
Tracking daily next

Progress over time

Strong trust
20.2% (39) staged or trusted
Any trust
21.2% (41) incl. provenance
No trust signal
78.8% (152) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/249/39/119/169/2910/710/1610/22
  1. 41/193 any trust
  2. ...
    41/192 any trust
  3. ...
    41/191 any trust
  4. 41/188 any trust
  5. ...
    40/187 any trust
  6. 40/187 any trust
  7. 40/187 any trust
  8. 40/187 any trust
  9. 40/187 any trust
  10. ...
    40/187 any trust
  11. ...
    40/186 any trust
  12. 40/186 any trust
  13. 40/186 any trust
  14. ...
    37/186 any trust
  15. 37/179 any trust
  16. 37/179 any trust
  17. ...
    37/179 any trust
  18. 37/179 any trust
  19. 37/179 any trust
  20. 37/179 any trust
  21. ...
    37/179 any trust
  22. ...
    37/179 any trust
  23. 38/178 any trust
  24. 38/178 any trust
  25. 38/178 any trust
  26. 38/178 any trust
  27. ... [viewing]
    38/178 any trust
    1. [viewing]
  28. ...
    38/178 any trust
  29. ...
    38/178 any trust
  30. ...
    38/178 any trust
  31. ...
    38/178 any trust
  32. 37/178 any trust
  33. ...
    37/178 any trust
  34. 37/177 any trust
  35. ...
    37/177 any trust
  36. 37/176 any trust
  37. 37/176 any trust
  38. 37/176 any trust
  39. 37/176 any trust
  40. 36/176 any trust
In scope
178
Staged publish
0
Trusted publisher
35
Provenance only
3
No trust signal
140
Deprecated latest
8
178 packages · click a column to sort
Package trust level report
vercel59.16.0noneGitHub Actions2,789,836—
@vercel/nestjs8.0.0noneGitHub Actions2,407,563—
@vercel/h38.0.0noneGitHub Actions2,443,047—
@vercel/container8.0.0noneGitHub Actions1,736,619—
@vercel/cervel0.1.64noneGitHub Actions2,431,443—
@vercel/express8.0.0noneGitHub Actions2,511,367—
@vercel/client18.4.0noneGitHub Actions32,314—
@vercel/python14.0.0noneGitHub Actions2,705,020—
@vercel/build-utils14.10.0noneGitHub Actions3,589,744—
@vercel/node13.0.0noneGitHub Actions3,274,315—
@vercel/hono8.0.0noneGitHub Actions2,518,121—
@vercel/next12.0.0noneGitHub Actions2,718,826—
@vercel/go11.0.0noneGitHub Actions2,690,173—
@vercel/koa8.0.0noneGitHub Actions2,337,961—
@vercel/rust9.0.0noneGitHub Actions2,405,059—
@vercel/ruby10.0.0noneGitHub Actions2,683,771—
@vercel/fastify8.0.0noneGitHub Actions2,414,851—
@vercel/backends8.0.0noneGitHub Actions2,424,443—
@vercel/elysia8.0.0noneGitHub Actions2,413,071—
@vercel/static-build10.0.0noneGitHub Actions2,686,712—
@vercel/remix-builder13.0.0noneGitHub Actions2,671,141—
@vercel/hydrogen9.0.0noneGitHub Actions2,671,622—
@vercel/redwood10.0.0noneGitHub Actions2,682,353—
@vercel/gatsby-plugin-vercel-builder2.2.56noneGitHub Actions2,678,153—
@vercel/fs-detectors7.2.4noneGitHub Actions228,605—
@vercel/vc-native-linux-arm6459.16.0noneGitHub Actions87,024—
@vercel/vc-native-linux-x6459.16.0noneGitHub Actions1,171,934—
@vercel/vc-native59.16.0noneGitHub Actions1,458—
@vercel/vc-native-darwin-x6459.16.0noneGitHub Actions58,028—
@vercel/vc-native-darwin-arm6459.16.0noneGitHub Actions221,955—
@vercel/error0.1.5trusted publisherGitHub Actions1,470—
@vercel/sdk1.28.30trusted publisherGitHub Actions337,871—
@vercel/oidc3.8.7noneGitHub Actions23,238,316—
@vercel/functions3.9.7noneGitHub Actions5,082,879—
@vercel/cli-auth0.3.7noneGitHub Actions2,496,604—
@vercel/cli-config0.2.6noneGitHub Actions5,905,882—
@vercel/aws0.2.14noneGitHub Actions358—
@vercel/oidc-aws-credentials-provider3.3.7noneGitHub Actions222,959—
@vercel/kms0.1.3noneGitHub Actions357—
@vercel/connect2.0.4noneGitHub Actions330,907—
workflow4.8.8trusted publisherGitHub Actions874,733—
ai7.0.97trusted publisherGitHub Actions18,223,703—
@vercel/geistdocs1.28.1noneGitHub Actions28,991—
flags4.3.1trusted publisherGitHub Actions868,394—
@vercel/flags-core1.8.1trusted publisherGitHub Actions493,414—
run2.1.4trusted publisherGitHub Actions94,241—
agent-browser0.37.1trusted publisherGitHub Actions1,035,933—
@vercel/sandbox3.2.2trusted publisherGitHub Actions3,203,761—
sandbox4.3.0trusted publisherGitHub Actions2,105,851—
@vercel/sandbox-mock3.2.2trusted publisherGitHub Actions4,991—
libfx0.0.8trusted publisherGitHub Actions973—
@vercel/slack-bolt1.6.5trusted publisherGitHub Actions36,800—
@vercel/factory0.0.14noneGitHub Actions357—
@vercel/agent-readability0.7.0noneGitHub Actions57,639—
@vercel/frameworks3.34.0noneGitHub Actions682,910—
next16.3.4trusted publisherGitHub Actions42,821,688—
@vercel/config0.7.0noneGitHub Actions255,178—
create-v0-sdk-app3.0.6trusted publisherGitHub Actions247—
v03.0.6trusted publisherGitHub Actions17,483—
@vercel/queue0.5.1noneGitHub Actions1,107,684—
@vercel/static-config3.4.3noneGitHub Actions3,152,263—
@vercel/react-router1.3.6noneGitHub Actions100,359—
@vercel/schedules0.0.0nonevercel-release-bot279—
@vercel/agent-eval2.2.1trusted publisherGitHub Actions69,260—
@vercel/og1.0.2noneGitHub Actions1,568,999—
streamdown2.6.0trusted publisherGitHub Actions4,601,968—
satori0.33.4trusted publisherGitHub Actions2,846,950—
@vercel/python-analysis0.14.0noneGitHub Actions2,549,962—
@vercel/webpack-asset-relocator-loader1.11.0trusted publisherGitHub Actions219,556—
@vercel/nft1.11.0trusted publisherGitHub Actions6,968,387—
remote-components0.4.15noneGitHub Actions11,646—
mcp-handler2.1.1trusted publisherGitHub Actions794,344—
@vercel/routing-utils6.5.0noneGitHub Actions891,278—
@vercel/ncc0.45.0trusted publisherGitHub Actions675,409—
@vercel/edge1.3.3noneGitHub Actions579,421—
@vercel/detect-agent1.2.5noneGitHub Actions2,687,309—
@vercel/firewall1.2.5noneGitHub Actions114,610—
@vercel/blob2.8.0trusted publisherGitHub Actions4,841,131—
@vercel/edge-config1.5.1trusted publisherGitHub Actions732,930—
@vercel/global-config1.5.1trusted publisherGitHub Actions97,366—
@vercel/global-config-fs0.1.0noneandybitz197,372—
@vercel/related-projects1.1.1noneGitHub Actions58,730—
@vercel/passport1.0.1noneGitHub Actions19,639—
@vercel/gatsby-plugin-vercel-analytics1.0.12noneGitHub Actions2,401,063—
@vercel/error-utils2.2.1noneGitHub Actions3,476,466—
@vercel/cli-exec1.0.1noneGitHub Actions4,814,924—
v0-sdk0.16.7trusted publisherGitHub Actions26,171—
@vercel/vc-native-win32-x6458.4.0trusted publisherGitHub Actions486—
@vercel/toolbar0.2.7noneGitHub Actions321,102—
@vercel/microfrontends2.4.0trusted publisherGitHub Actions730,956—
@vercel/prepare-flags-definitions0.4.0trusted publisherGitHub Actions2,245,543—
@vercel/otel2.1.3trusted publisherGitHub Actions1,887,052—
experimental-ash0.64.1noneGitHub Actions1,281—
create-experimental-ash-agent0.7.0noneGitHub Actions14—
next-forge6.0.3trusted publisherGitHub Actions40—
@vercel/vclaw0.3.10trusted publisherGitHub Actions11—
mixpart0.0.6noneGitHub Actions1,761,338—
@vercel/connex0.0.11noneGitHub Actions15—
@vercel/next-browser0.7.1nonejudegao16,598—
@vercel/ai-sdk-openai-websocket-fetch1.0.0nonevercel-release-bot6,936—
@vercel/stega1.1.0nonevercel-release-bot1,764,787—
@vercel/analytics2.0.1nonevercel-release-bot4,901,021—
ai-elements1.9.0trusted publisherGitHub Actions88,845—
@vercel/fun1.3.1nonevercel-release-bot2,507,263—
@vercel/speed-insights2.0.0nonevercel-release-bot3,256,968—
@vercel/cosmosdb-server1.0.1nonevercel-release-bot187,812—
botid1.5.11nonevercel-release-bot596,287—
@vercel/nextdocfs0.5.1nonejudegao6—
@vercel/kv20.0.19nonecramforce181—
@vercel/dream0.4.0noneGitHub Actions29—
@vercel/beautiful-mermaid0.1.5nonejohnphamous4,401—
@vercel/mcp-adapter0.3.2provenancevercel-release-bot43,823—
@vercel/create-dream0.2.2noneadriancooney_vercel6—
@vercel/dream-init0.2.2noneadriancooney_vercel6—
@vercel/agent-eval-playground0.1.3trusted publisherGitHub Actions1,068—
@vercel/introspection0.0.13provenancevercel-release-bot96,222—
@vercel/v00.0.1-alpha.1nonefernandorojo6—
@vercel/before-and-after0.0.4nonejamesvclements1,691—
@vercel/sandbox-cli1.1.1nonevercel-release-bot500DEPRECATED
@vercel/examples-ui2.0.4nonevercel-release-bot550—
react-chatgpt-hooks0.0.1nonequuu7—
@vercel/platforms1.0.0nonehaydenbleasel46—
@vercel/ade0.0.24nonerobpruzan29—
mcp-to-ai-sdk0.1.1nonevercel-release-bot53—
@vercel/remix-run-dev2.16.7nonevercel-release-bot4,369—
@vercel/remix2.16.7nonevercel-release-bot35,893—
@vercel/repository-dispatch-status0.0.1nonevercel-release-bot7—
@vercel/repository-dispatch-checkout0.0.1nonevercel-release-bot3—
@vercel/ai-sdk-gateway0.1.10nonevercel-release-bot138DEPRECATED
@vercel/repository-dispatch0.1.0nonevercel-release-bot60—
@vercel/flags3.1.1nonevercel-release-bot51,775DEPRECATED
@vercel/sqs-consumer5.7.0nonemglagola30—
@vercel/devlow-bench0.3.5provenancevercel-release-bot2,176—
@vercel/kv3.0.0nonevercel-release-bot310,060DEPRECATED
@vercel/postgres-kysely0.10.0nonevercel-release-bot1,764DEPRECATED
@vercel/postgres0.10.0nonevercel-release-bot280,021DEPRECATED
@vercel/style-guide6.0.0nonevercel-release-bot220,014—
@vercel/remote-nx2.0.0nonevercel-release-bot8,653—
@vercel/fetch7.0.0nonevercel-release-bot460,306—
@vercel/visual-editing0.0.1nonevercel-release-bot5—
@vercel/ai-utils0.0.2nonejaredpalmer49—
@vercel/edge-config-fs0.1.0nonevercel-release-bot558,196—
@vercel/remix-entry-server0.1.1nonevercel-release-bot145—
@vercel/node-bridge4.0.1nonevercel-release-bot31,899—
@vercel/algolite0.3.0-canary.1noneofhouse3—
@vercel/experimental-nft-next-plugin0.0.1nonevercel-release-bot10—
@vercel/fetch-cached-dns2.1.2nonevercel-release-bot300,101—
@vercel/remote-rush1.0.1nonevercel-release-bot58,630—
@vercel/remote1.0.1nonevercel-release-bot67,412—
@vercel/webpack-nft0.0.14nonevercel-release-bot17—
@vercel/nft-next-plugin0.0.13nonevercel-release-bot11—
@vercel/experimental-nft0.0.4nonevercel-release-bot11—
@vercel/experimental-nft-win32-x640.0.4nonevercel-release-bot10—
@vercel/experimental-nft-darwin-arm640.0.4nonevercel-release-bot11—
@vercel/experimental-nft-darwin-x640.0.4nonevercel-release-bot10—
@vercel/experimental-nft-linux-x640.0.4nonevercel-release-bot11—
@vercel/wireguard0.0.7noneemeraldsanto14—
@vercel/examples-ui-svelte0.1.16nonegbibeaulaviolette24—
@vercel/satori-node0.0.22nonestyfle4—
@vercel/satori-core0.0.22nonestyfle3—
@vercel/edge-jest-environment0.12.4nonekikobeats32—
@vercel/edge-runtime0.12.4nonekikobeats44DEPRECATED
@vercel/edge-vm0.12.4nonekikobeats42—
@vercel/edge-types0.12.4nonekikobeats14—
@vercel/edge-primitives0.12.4nonekikobeats57—
@vercel/edge-format0.12.2nonekikobeats22—
@vercel/format0.11.0nonekikobeats3—
@vercel/fetch-retry5.1.3noneethan_arrowood308,661—
@vercel/mdx-deck-theme0.3.1nonedav-is4—
@vercel/edge-functions-ui0.2.1nonelfades898—
async-sema3.1.1noneleerobinson7,172,486—
@vercel/tracing-js0.5.1nonestyfle42DEPRECATED
@vercel/git-hooks1.0.0noneleerobinson10,621—
@vercel/cgi1.0.7nonezeit-bot17—
@vercel/docs-generator0.2.0nonequietshu16—
@vercel/integration-utils0.6.5-canary.0nonetootallnate6—
vercel-client1.0.0noneleo4—
vc0.1.4nonelepture424—