@actions/core
Actions core lib
78%
Total Score
healthy
Healthy: established releases and organization backing outweigh workflow pinning and audit concerns.
Health Score Breakdown
Only three commits from two active maintainers were recorded in the last three months, which is modest activity, but the regular release history and organization backing partly compensate.
The audit analyzed all eight workflows without failures and found no untrusted checkout or script-injection path, but all 33 action references are unpinned and high-confidence template-injection findings occur in the release workflow.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2022-35954 @actions/core is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 0.0.0 - 1.9.0. | 0.0.0 - 1.9.0 | Medium |
CVE-2020-15228 @actions/core is vulnerable to Improper Input Validation in versions 0.0.0 - 1.2.6. | 0.0.0 - 1.2.6 | Low |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @actions/exec Version ^3.0.0 | — | — |
@actions/http-client Version ^4.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 5 months ago
- Created
- 7 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.