@builder.io/react
NOTE: If you want to register your React Server Components as custom components in Builder, you will need to use our experimental NextJS SDK [here](https://github.com/BuilderIO/builder/tree/main/packages/sdks/output/nextjs).
76%
Total Score
healthy
Healthy overall, with active releases and project backing offset by risky GitHub workflow hygiene.
Health Score Breakdown
All five workflows were analyzed with no untrusted checkouts or script injections, but all 33 action references are unpinned and two high-confidence findings report GitHub App tokens inheriting blanket installation permissions; three workflows also grant top-level write access.
The repository name does not match the package and its README does not mention @builder.io/react, so the package-to-repository relationship is less transparent, although the organization backing partly offsets that concern.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2024-10445 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @builder.io/react is vulnerable to Cross-site Scripting (XSS) in versions 0.1.0 - 6.0.1. | 0.1.0 - 6.0.1 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 preact Version ^10.1.0 | — | — |
hash-sum Version ^2.0.0 | — | — |
isolated-vm Version ^6.0.0 | — | — |
@emotion/core Version ^10.0.17 | — | — |
@builder.io/sdk Version 6.3.3 | — | — |
Weekly Downloads
Info
- Last Published
- 16 days ago
- Created
- 8 years ago
- Unpacked Size
- 5.4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.