@clickhouse/client
The package has a mature release record, active repository work, typed artifacts, and reproducible npm provenance. Workflow permissions and credential-handling findings need attention, but they do not outweigh the project's maintenance and ownership signals.
84%
Total Score
83
100
100
67
100
Health Score Breakdown
Six of seven publishing accounts use the clickhouse.com domain, consistent with the organization-backed repository. The hoorayimhelping Gmail account is an account-hygiene caution, but it does not outweigh the clear company ownership.
No SECURITY.md policy was detected. This is a transparency gap for reporting vulnerabilities, although the repository does have several automated security-scanning tools.
All 25 workflows were analyzed, and only 2 of 102 action references are unpinned; however, a high-confidence github-app finding grants blanket app permissions and a medium-confidence secrets-inherit finding broadens credential access. Six workflows also use top-level write permissions, while the audit had one failed file, so workflow hygiene warrants caution.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 1 day ago
- Created
- 4 years ago
- Unpacked Size
- 1.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.