@ai-sdk/provider-utils
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| npm-metadata | no-description | AI (npm-metadata): Minor metadata gap; package is clearly legitimate with 17M weekly downloads. | ai | |
| provenance | publisher-changed | AI (provenance): Legitimate transition from jaredpalmer (Vercel employee) to vercel-release-bot (Vercel's automated release account). Both are within the Vercel org. | ai | |
| provenance | missing-githead | AI (provenance): Consistent with move to bot-based CI/CD publishing at Vercel; not a security concern for this package. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): vercel-release-bot added as part of standard Vercel org transition to automated releases. | ai | |
| npm-metadata | suspicious-initial-version | AI (npm-metadata): Version 0.0.0 is a known monorepo workspace placeholder pattern used by the Vercel AI SDK; not indicative of malicious intent for this package. | ai | |
| bogus-package | bogus-package | AI (bogus-package): 17M weekly downloads and 738-day history confirm this is a legitimate, high-value package despite sparse README/description metadata. | ai |
Versions (showing 70 of 270)
v0.0.0-fd764a60-20260114143805
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.0-bf6e4b15-20260402200305
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.0-b66d09a8-20260328011513
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.0-70e0935a-20260114150030
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.0-64aae7dd-20260114144918
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.0.0-4115c213-20260122152721
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.0-1c33ba03-20260114162300
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.0.0-01d6317c-20260129172110
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.