The Vite plugin for base44 based applications
67%
Total Score
caution
Frequent stable releases and good package documentation are offset by weak source transparency and unverifiable build provenance.
The package has no build attestation and does not use staged publishing. The trusted publisher ID is GitHub, but without an attestation the artifact's build origin cannot be independently verified.
Five of eleven publishing accounts use the primary wix.com domain, while two publish through Gmail accounts: netanelgilad and roymiloh. Those personal publishing accounts create account-continuity hygiene risk, though the company-domain presence is compensating evidence.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@babel/types Version ^7.28.5 | — | — |
@babel/parser Version ^7.28.5 | — | — |
@babel/traverse Version ^7.28.5 | — | — |
@babel/generator Version ^7.28.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.