@capacitor/android
Capacitor: Cross-platform apps with JavaScript and the web
72%
Total Score
caution
Active project, but its release workflows use unpinned actions and high-confidence template-injection patterns.
Health Score Breakdown
All 40 action references are unpinned, eight workflows grant top-level write permissions, and seven high-confidence template-injection findings affect publishing workflows. No untrusted checkout or dangerous trigger was found, so this is a meaningful hygiene and supply-chain caution rather than a standalone severe verdict.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-297931 @capacitor/android is vulnerable to Cross-Site Scripting (XSS) in versions 5.7.1 - 6.2.1, 7.0.0 - 7.6.8, 8.0.0 - 8.4.2 and 8.5.0 - 8.5.0. | 5.7.1 - 6.2.17.0.0 - 7.6.88.0.0 - 8.4.2 +1 more | Critical |
Package versions
Maintainers
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 6 days ago
- Created
- 8 years ago
- Unpacked Size
- 0.5 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.