A CSS selector engine.
84%
Total Score
healthy
Active releases and repository work support this package, despite concentrated commit activity and unpinned workflow actions.
The repository is owned by an individual rather than an organization, so the concentrated contributor activity is not offset by visible organizational maintenance capacity.
Five contributors were active, but the leading contributor made 88% of recent commits, concentrating maintenance capacity and creating continuity risk for a user-owned project.
All workflows were analyzed and use read-only permissions, with no untrusted checkouts or script injection detected. All four action references are unpinned, a workflow hygiene weakness; the reported cache-poisoning finding is low confidence and does not independently lower the score.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
bidi-js Version ^1.1.0 | — | — |
css-tree Version ^3.2.1 | — | — |
lru-cache Version ^11.5.3 | — | — |
is-potential-custom-element-name Version ^1.0.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.