@cubejs-backend/cubesql

SQL API for Cube as proxy over MySQL protocol.

Latest 1.8.6

78%

Total Score

healthy

Active, organization-backed project with strong release activity, but unpinned workflows and workflow audit findings reduce supply-chain confidence.

Are you affected? Scan for Free

Health Score Breakdown

Maintainers

The package has four publish accounts, with two on the cube.dev domain and the project backed by an organization; keydunov (gmail.com) and statsbot (statsbot.co) are account-hygiene cautions, not evidence of maintenance capacity.

Repo package mention

The repository name does not match the package and its README does not mention the package, creating uncertainty about the exact package-to-repository relationship; the organization and monorepo-scale tree partly compensate.

Type declarations

No type declarations are published, which reduces ergonomics and compile-time safety for TypeScript consumers of this library.

Workflow audit

All 253 analyzed action references are unpinned, and high-confidence template-injection findings occur in three workflows; no untrusted checkout or script-injection sink was found, so this is a material hygiene concern rather than a standalone severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10450 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @cubejs-backend/cubesql is vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in versions 0.34.11 - 1.3.34.	0.34.11 - 1.3.34	Low