This repo hosts the source for Apollo Studio's Embeddable Explorer
64%
Total Score
caution
Usable with caveats: repository commit activity has stopped for three months despite a recent push.
The package has 35 releases since February 2022, but only one release in the last 12 months, indicating a materially slower cadence for an established package.
The repository recorded zero commits and zero active maintainers during the last three months, a significant maintenance concern despite the recent push timestamp.
There were no new or closed issues and no merged pull requests in the last month, while eight issues and 19 pull requests remain open, suggesting limited recent project throughput.
The repository uses TypeScript, npm scripts, Rollup, and Babel for builds, but no security scanning tools were detected, leaving a modest transparency and hygiene gap.
All three workflows were analyzed and none has untrusted-checkout or script-injection findings, but all seven action references are unpinned and a high-confidence audit found ad hoc package installation.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10672 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @apollo/explorer is vulnerable to Cross-Site Request Forgery (CSRF) in versions 1.0.0 - 3.7.3. | 1.0.0 - 3.7.3 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
graphql-ws Version ^5.9.0 | — | — |
whatwg-mimetype Version ^3.0.0 | — | — |
zen-observable-ts Version ^1.1.0 | — | — |
@types/whatwg-mimetype Version ^3.0.0 | — | — |
subscriptions-transport-ws Version ^0.11.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.