commons-asic
Generic implementation of ASiC-E archives in accordance with ETSI 102 918 v1.3.1.
76%
Total Score
90
100
94
50
100
Health Score Breakdown
The package has 11 releases over roughly 11 years, but none in the last 12 months. Recent repository commits partly compensate for the slow registry cadence.
There are three open issues and 11 open pull requests, with one pull request merged in the last month; this shows some ongoing responsiveness but limited recent issue movement.
No security policy is present in the repository, leaving vulnerability-reporting expectations unclear for a cryptographic archive library.
All three workflows were analyzed without high-severity findings, but all three action references are unpinned, two workflows grant top-level write permissions, and high-confidence secrets-inherit findings widen credential exposure.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10303 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. commons-asic is vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in versions 0.9.4 - 1.0.0. | 0.9.4 - 1.0.0 | Medium |
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 jakarta.xml.bind:jakarta.xml.bind-api Version 4.0.2 | — | — |
jakarta.annotation:jakarta.annotation-api Version 3.0.0 | — | — |
org.slf4j:slf4j-api Version 2.0.16 | — | — |
org.bouncycastle:bcpkix-jdk18on Version 1.79 | — | — |
com.google.guava:guava Version 33.4.0-jre | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 10 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.