@contentstack/utils

Contentstack utilities for Javascript

Latest 1.9.1

NPM

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher identity is present, leaving release origin less independently verifiable despite the active source repository and established release history.

Repo bus factor

One contributor made all five recent commits, creating concentration risk. Organization ownership provides some handoff capacity, but no second recent contributor is shown to be active.

Workflow audit

All seven workflows were analyzed with no untrusted checkouts or script injection, and two scope permissions at job level. However, all 19 action references are unpinned; the low-confidence cache findings are hygiene concerns, while the trusted-publishing findings are informational in this audit.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10114 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @contentstack/utils is vulnerable to Improper Neutralization of Script-Related HTML Tags in versions 1.0.0 - 1.3.18.	1.0.0 - 1.3.18	Medium
AIKIDO-2025-10098 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @contentstack/utils is vulnerable to Cross-site Scripting (XSS) in versions 1.1.0 - 1.3.17.	1.1.0 - 1.3.17	Medium
AIKIDO-2024-10194 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @contentstack/utils is vulnerable to Cross-site Scripting (XSS) in versions 1.0.0 - 1.3.8.	1.0.0 - 1.3.8	Low
AIKIDO-2024-10097 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @contentstack/utils is vulnerable to Cross-site Scripting (XSS) in versions 1.0.0 - 1.3.3.	1.0.0 - 1.3.3	Medium