npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of vercel, generated . This is a read-only snapshot.
Run your own audit →

Audit of vercel

Re-run this audit
Tracking daily next

Progress over time

Strong trust
20.7% (39) staged or trusted
Any trust
21.8% (41) incl. provenance
No trust signal
78.2% (147) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/249/39/169/3010/710/16
  1. 41/188 any trust
  2. ...
    40/187 any trust
  3. 40/187 any trust
  4. 40/187 any trust
  5. 40/187 any trust
  6. 40/187 any trust
  7. ...
    40/187 any trust
  8. ... [viewing]
    40/186 any trust
    1. [viewing]
  9. 40/186 any trust
  10. 40/186 any trust
  11. ...
    37/186 any trust
  12. 37/179 any trust
  13. 37/179 any trust
  14. ...
    37/179 any trust
  15. 37/179 any trust
  16. 37/179 any trust
  17. 37/179 any trust
  18. ...
    37/179 any trust
  19. ...
    37/179 any trust
  20. 38/178 any trust
  21. 38/178 any trust
  22. 38/178 any trust
  23. 38/178 any trust
  24. ...
    38/178 any trust
  25. ...
    38/178 any trust
  26. ...
    38/178 any trust
  27. ...
    38/178 any trust
  28. ...
    38/178 any trust
  29. 37/178 any trust
  30. ...
    37/178 any trust
  31. 37/177 any trust
  32. ...
    37/177 any trust
  33. 37/176 any trust
  34. 37/176 any trust
  35. 37/176 any trust
  36. 37/176 any trust
  37. 36/176 any trust
In scope
186
Staged publish
0
Trusted publisher
37
Provenance only
3
No trust signal
146
Deprecated latest
11
186 packages · click a column to sort
Package trust level report
ai7.0.123trusted publisherGitHub Actions31,596,868—
@vercel/factory0.0.26noneGitHub Actions1,257—
@vercel/vc-native-win32-x6461.1.0noneGitHub Actions353,818—
vercel61.1.0noneGitHub Actions5,433,897—
@vercel/client18.4.8noneGitHub Actions55,324—
@vercel/vc-native61.1.0noneGitHub Actions24,841—
@vercel/vc-native-linux-arm6461.1.0noneGitHub Actions215,868—
@vercel/vc-native-win32-arm6461.1.0noneGitHub Actions119,205—
@vercel/vc-native-linux-x6461.1.0noneGitHub Actions2,938,644—
@vercel/vc-native-darwin-x6461.1.0noneGitHub Actions151,747—
@vercel/vc-native-darwin-arm6461.1.0noneGitHub Actions397,354—
@vercel/agent-eval2.4.0trusted publisherGitHub Actions113,689—
@vercel/sdk1.28.38trusted publisherGitHub Actions556,579—
create-v0-sdk-app3.0.8trusted publisherGitHub Actions522—
v03.0.8trusted publisherGitHub Actions26,250—
next16.3.7trusted publisherGitHub Actions70,004,350—
@vercel/connect2.3.4noneGitHub Actions658,252—
@vercel/rust12.0.2noneGitHub Actions4,828,144—
@vercel/static-build13.0.2noneGitHub Actions5,249,794—
@vercel/node16.0.2noneGitHub Actions6,198,110—
@vercel/ruby13.0.2noneGitHub Actions5,253,225—
@vercel/go14.0.2noneGitHub Actions5,258,853—
@vercel/express11.0.2noneGitHub Actions4,979,604—
@vercel/nestjs11.0.2noneGitHub Actions4,825,424—
@vercel/koa11.0.2noneGitHub Actions4,710,449—
@vercel/hono11.0.2noneGitHub Actions4,994,979—
@vercel/h311.0.2noneGitHub Actions4,885,901—
@vercel/fastify11.0.2noneGitHub Actions4,837,798—
@vercel/elysia11.0.2noneGitHub Actions4,835,777—
@vercel/frameworks3.35.0noneGitHub Actions1,448,908—
@vercel/build-utils14.13.2noneGitHub Actions6,772,416—
@vercel/fs-detectors7.8.0noneGitHub Actions675,242—
@vercel/cervel0.1.71noneGitHub Actions4,863,381—
@vercel/gatsby-plugin-vercel-builder2.2.63noneGitHub Actions5,237,392—
@vercel/remix-builder16.0.2noneGitHub Actions5,226,731—
@vercel/redwood13.0.2noneGitHub Actions5,238,882—
@vercel/python17.0.2noneGitHub Actions5,270,385—
@vercel/next15.0.2noneGitHub Actions5,323,141—
@vercel/backends11.0.2noneGitHub Actions4,847,068—
@vercel/hydrogen12.0.2noneGitHub Actions5,228,659—
@vercel/container11.0.2noneGitHub Actions3,839,419—
@vercel/react-router1.3.7noneGitHub Actions153,631—
@vercel/static-config3.4.4noneGitHub Actions5,865,800—
@vercel/fun1.3.6trusted publisherGitHub Actions4,997,636—
@vercel/remix-run-dev2.16.7-patch.1trusted publisherGitHub Actions7,927—
@vercel/remix2.16.7-patch.1trusted publisherGitHub Actions51,031—
@vercel/geistdocs2.7.5noneGitHub Actions54,946—
@vercel/sandbox-mock3.5.1trusted publisherGitHub Actions7,033—
sandbox4.6.0trusted publisherGitHub Actions4,342,399—
@vercel/sandbox3.5.1trusted publisherGitHub Actions6,482,660—
@vercel/slack-bolt1.7.1trusted publisherGitHub Actions66,292—
@vercel/nft-oxc-win32-x640.0.0nonevercel-release-bot142—
@vercel/nft-oxc-linux-x640.0.0nonevercel-release-bot146—
@vercel/nft-oxc-linux-arm640.0.0nonevercel-release-bot160—
@vercel/nft-oxc-darwin-x640.0.0nonevercel-release-bot149—
@vercel/nft-oxc0.0.0nonevercel-release-bot147—
@vercel/nft-oxc-darwin-arm640.0.0nonevercel-release-bot153—
@vercel/nft-oxc-win32-arm640.0.0nonevercel-release-bot143—
@vercel/flags-core1.8.3trusted publisherGitHub Actions1,003,779—
@vercel/queue0.7.0noneGitHub Actions1,977,642—
libfx0.0.11trusted publisherGitHub Actions2,270—
@vercel/kms0.3.0noneGitHub Actions1,142—
@vercel/config0.7.2noneGitHub Actions411,619—
@vercel/og1.0.3noneGitHub Actions2,216,329—
satori0.33.5trusted publisherGitHub Actions4,370,901—
@vercel/oidc-aws-credentials-provider3.3.9noneGitHub Actions495,503—
@vercel/functions3.9.9noneGitHub Actions9,566,325—
@vercel/aws0.2.16noneGitHub Actions411—
@vercel/oidc3.8.9noneGitHub Actions42,431,396—
@vercel/cli-auth0.3.9noneGitHub Actions5,056,220—
@vercel/cli-config0.3.0noneGitHub Actions12,503,708—
@vercel/passport1.1.0noneGitHub Actions37,069—
run2.1.5trusted publisherGitHub Actions162,623—
@vercel/error0.3.0trusted publisherGitHub Actions10,033—
mcp-handler2.2.0trusted publisherGitHub Actions1,312,129—
agent-browser0.38.1trusted publisherGitHub Actions2,021,532—
workflow4.8.9trusted publisherGitHub Actions1,510,236—
@vercel/routing-utils6.6.0noneGitHub Actions1,748,005—
flags4.3.1trusted publisherGitHub Actions1,610,630—
@vercel/agent-readability0.7.0noneGitHub Actions118,048—
@vercel/schedules0.0.0nonevercel-release-bot21,122—
streamdown2.6.0trusted publisherGitHub Actions7,522,559—
@vercel/python-analysis0.14.0noneGitHub Actions5,137,544—
@vercel/webpack-asset-relocator-loader1.11.0trusted publisherGitHub Actions336,835—
@vercel/nft1.11.0trusted publisherGitHub Actions11,975,573—
remote-components0.4.15noneGitHub Actions15,149—
@vercel/ncc0.45.0trusted publisherGitHub Actions1,124,076—
@vercel/edge1.3.3noneGitHub Actions900,051—
@vercel/detect-agent1.2.5noneGitHub Actions5,387,490—
@vercel/firewall1.2.5noneGitHub Actions244,825—
@vercel/blob2.8.0trusted publisherGitHub Actions8,990,995—
@vercel/edge-config1.5.1trusted publisherGitHub Actions1,159,469DEPRECATED
@vercel/global-config1.5.1trusted publisherGitHub Actions183,716—
@vercel/global-config-fs0.1.0noneandybitz397,622—
@vercel/related-projects1.1.1noneGitHub Actions102,860—
@vercel/gatsby-plugin-vercel-analytics1.0.12noneGitHub Actions4,797,373—
@vercel/error-utils2.2.1noneGitHub Actions6,666,619—
@vercel/cli-exec1.0.1noneGitHub Actions9,604,500—
v0-sdk0.16.7trusted publisherGitHub Actions52,633—
@vercel/toolbar0.2.7noneGitHub Actions618,744—
@vercel/microfrontends2.4.0trusted publisherGitHub Actions1,517,550—
@vercel/prepare-flags-definitions0.4.0trusted publisherGitHub Actions4,826,149—
@vercel/otel2.1.3trusted publisherGitHub Actions3,321,691—
experimental-ash0.64.1noneGitHub Actions2,176—
create-experimental-ash-agent0.7.0noneGitHub Actions12—
next-forge6.0.3trusted publisherGitHub Actions40—
@vercel/vclaw0.3.10trusted publisherGitHub Actions8—
mixpart0.0.6noneGitHub Actions3,024,552—
@vercel/connex0.0.11noneGitHub Actions12—
@vercel/next-browser0.7.1nonejudegao26,687—
@vercel/ai-sdk-openai-websocket-fetch1.0.0nonevercel-release-bot20,173—
@vercel/stega1.1.0nonevercel-release-bot2,811,181—
@vercel/analytics2.0.1nonevercel-release-bot8,475,994—
ai-elements1.9.0trusted publisherGitHub Actions159,686—
@vercel/speed-insights2.0.0nonevercel-release-bot5,529,122—
@vercel/cosmosdb-server1.0.1nonevercel-release-bot503,217—
botid1.5.11nonevercel-release-bot1,198,286—
@vercel/nextdocfs0.5.1nonejudegao6—
@vercel/kv20.0.19nonecramforce167—
@vercel/dream0.4.0noneGitHub Actions9—
@vercel/beautiful-mermaid0.1.5nonejohnphamous5,065—
@vercel/mcp-adapter0.3.2provenancevercel-release-bot56,177—
@vercel/create-dream0.2.2noneadriancooney_vercel3—
@vercel/dream-init0.2.2noneadriancooney_vercel4—
@vercel/agent-eval-playground0.1.3trusted publisherGitHub Actions2,238—
@vercel/introspection0.0.13provenancevercel-release-bot163,012—
@vercel/v00.0.1-alpha.1nonefernandorojo4—
@vercel/before-and-after0.0.4nonejamesvclements1,586DEPRECATED
@vercel/sandbox-cli1.1.1nonevercel-release-bot1,447DEPRECATED
@vercel/examples-ui2.0.4nonevercel-release-bot1,333—
react-chatgpt-hooks0.0.1nonequuu2—
@vercel/platforms1.0.0nonehaydenbleasel177—
@vercel/ade0.0.24nonerobpruzan6—
mcp-to-ai-sdk0.1.1nonevercel-release-bot68—
@vercel/repository-dispatch-status0.0.1nonevercel-release-bot3—
@vercel/repository-dispatch-checkout0.0.1nonevercel-release-bot3—
@vercel/ai-sdk-gateway0.1.10nonevercel-release-bot103DEPRECATED
@vercel/repository-dispatch0.1.0nonevercel-release-bot40—
@vercel/flags3.1.1nonevercel-release-bot97,119DEPRECATED
@vercel/sqs-consumer5.7.0nonemglagola17—
@vercel/devlow-bench0.3.5provenancevercel-release-bot3,214—
@vercel/kv3.0.0nonevercel-release-bot431,866DEPRECATED
@vercel/postgres-kysely0.10.0nonevercel-release-bot5,542DEPRECATED
@vercel/postgres0.10.0nonevercel-release-bot389,963DEPRECATED
@vercel/style-guide6.0.0nonevercel-release-bot320,013—
@vercel/remote-nx2.0.0nonevercel-release-bot21,898—
@vercel/fetch7.0.0nonevercel-release-bot1,141,504—
@vercel/visual-editing0.0.1nonevercel-release-bot2—
@vercel/ai-utils0.0.2nonejaredpalmer54—
@vercel/edge-config-fs0.1.0nonevercel-release-bot830,868DEPRECATED
@vercel/remix-entry-server0.1.1nonevercel-release-bot182—
@vercel/node-bridge4.0.1nonevercel-release-bot40,435—
@vercel/algolite0.3.0-canary.1noneofhouse1—
@vercel/experimental-nft-next-plugin0.0.1nonevercel-release-bot9—
@vercel/fetch-cached-dns2.1.2nonevercel-release-bot679,572—
@vercel/remote-rush1.0.1nonevercel-release-bot114,473—
@vercel/remote1.0.1nonevercel-release-bot136,457—
@vercel/webpack-nft0.0.14nonevercel-release-bot12—
@vercel/nft-next-plugin0.0.13nonevercel-release-bot5—
@vercel/experimental-nft0.0.4nonevercel-release-bot6—
@vercel/experimental-nft-win32-x640.0.4nonevercel-release-bot5—
@vercel/experimental-nft-darwin-arm640.0.4nonevercel-release-bot4—
@vercel/experimental-nft-darwin-x640.0.4nonevercel-release-bot5—
@vercel/experimental-nft-linux-x640.0.4nonevercel-release-bot7—
@vercel/wireguard0.0.7noneemeraldsanto14—
@vercel/examples-ui-svelte0.1.16nonegbibeaulaviolette7—
@vercel/satori-node0.0.22nonestyfle4—
@vercel/satori-core0.0.22nonestyfle3—
@vercel/edge-jest-environment0.12.4nonekikobeats9—
@vercel/edge-runtime0.12.4nonekikobeats15DEPRECATED
@vercel/edge-vm0.12.4nonekikobeats13—
@vercel/edge-types0.12.4nonekikobeats5—
@vercel/edge-primitives0.12.4nonekikobeats18—
@vercel/edge-format0.12.2nonekikobeats14—
@vercel/format0.11.0nonekikobeats4—
@vercel/fetch-retry5.1.3noneethan_arrowood687,917—
@vercel/mdx-deck-theme0.3.1nonedav-is5—
@vercel/edge-functions-ui0.2.1nonelfades1,965—
async-sema3.1.1noneleerobinson12,723,559—
@vercel/tracing-js0.5.1nonestyfle18DEPRECATED
@vercel/git-hooks1.0.0noneleerobinson14,260—
@vercel/cgi1.0.7nonezeit-bot8—
@vercel/docs-generator0.2.0nonequietshu9—
@vercel/integration-utils0.6.5-canary.0nonetootallnate15—
vercel-client1.0.0noneleo3—
vc0.1.4nonelepture649—