Facade over tracing concepts
79%
Total Score
healthy
Healthy overall, with active maintenance outweighing workflow hygiene and milestone-version caveats.
The repository name does not match the package and its README does not mention this artifact, creating a transparency concern; the repository tree does show the package's dedicated module under the tracing project.
This is a milestone prerelease, and 35% of recent releases were prereleases, so consumers should expect some API or behavior change before finalization.
All 11 workflows were analyzed, with no untrusted checkouts or script-injection findings; however, one workflow grants top-level write access, six of 16 action references are unpinned, and high-confidence template-injection hygiene findings remain.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-784840 micrometer-tracing-bridge-brave is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.6.6 and 1.7.0 - 1.7.0. | 0.0.1 - 1.6.61.7.0 - 1.7.0 | Medium |
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
org.jspecify:jspecify Version 1.0.1 | — | — |
io.micrometer:micrometer-tracing Version 1.8.0-M2 | — | — |
org.slf4j:slf4j-api Version 1.7.36 | — | — |
io.zipkin.brave:brave Version 6.3.1 | — | — |
io.zipkin.brave:brave-context-slf4j Version 6.3.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.