Package Health/@cloudflare/workerd-darwin-64

@cloudflare/workerd-darwin-64

👷 workerd for macOS 64-bit, Cloudflare's JavaScript/Wasm Runtime

Latest 1.20261013.1

NPM

82%

Total Score

healthy

Active, well-backed project with strong release and contributor activity, but GitHub Actions contain significant hygiene risks.

Are you affected? Scan for Free

Health Score Breakdown

Maintainers

Four publishing accounts are listed, with three using the cloudflare.com domain. The dash_service_account account uses cloudflare-ui.com, an outside-domain publishing identity that is a minor account-hygiene concern, not evidence of limited maintenance capacity.

Workflow audit

All 24 workflows were analyzed with no failed files, and the pull_request_target triggers have no untrusted checkouts or script-injection findings. However, 62 of 67 action references are unpinned, a container image is unpinned, and high-confidence template-injection findings remain in _bazel.yml and release.yml; these are meaningful workflow hygiene risks.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10345 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @cloudflare/workerd-darwin-64 is vulnerable to Use after free in versions 1.20260226.1 - 1.20260307.1.	1.20260226.1 - 1.20260307.1	Medium
AIKIDO-2025-10357 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @cloudflare/workerd-darwin-64 is vulnerable to Use after free in versions 1.20231218.0 - 1.20250606.0.	1.20231218.0 - 1.20250606.0	Medium
AIKIDO-2024-10107 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @cloudflare/workerd-darwin-64 is vulnerable to Memory Leak in versions 1.20221108.0 - 1.20240512.0.	1.20221108.0 - 1.20240512.0	Low