@cspell/dynamic-import
Dynamic Module Loader
78%
Total Score
healthy
Active, well-supported package with verified publishing, but a high-risk workflow permission finding and unclear package-to-repository match
Health Score Breakdown
The repository name does not match the package and its README does not mention @cspell/dynamic-import. This may be a legitimate monorepo subpackage, but the collected evidence does not directly confirm that relationship.
The audit found one high-confidence, high-severity github-app issue where an app token inherits blanket installation permissions, and 29 of 72 action uses are unpinned. There are no untrusted checkouts or script injections, and most workflows use read-only or job-level permissions, so this is a contained but real workflow risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @cspell/url Version 10.4.0 | — | — |
import-meta-resolve Version ^4.2.0 | — | — |
Weekly Downloads
Info
- Last Published
- 3 days ago
- Created
- 3 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.