78%
Total Score
healthy
Exceptional release and repository activity outweigh workflow permission and untrusted-checkout concerns.
The repository name does not match the package and its README does not mention the package, which is a transparency caution even though a subpackage in a monorepo can commonly use a shared repository.
All 13 workflows were analyzed and all action references are pinned, but the audit found high-confidence blanket app-token permissions, a high-confidence template-injection concern, and an untrusted checkout in a workflow_run workflow. The many low-confidence cache findings are hygiene concerns rather than decisive evidence.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@ai-sdk/openai Version 4.0.96 | — | — |
@ai-sdk/deepseek Version 3.0.67 | — | — |
@ai-sdk/provider Version 4.0.29 | — | — |
@ai-sdk/provider-utils Version 5.0.62 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.