Clear documentation, bundled types, and a well-structured artifact make integration straightforward. Workflow hygiene is strong overall, though the missing security policy and one archived action leave minor transparency concerns.
91%
Total Score
100
100
50
50
No build attestation or trusted-publisher provenance is recorded, which limits release traceability; the active organization-backed repository and strong release activity partly compensate.
The repository has no published security policy, leaving vulnerability-reporting and response expectations less transparent than they could be.
All six workflows were analyzed, all 15 action references are pinned, and no untrusted checkout or script injection was found. One high-severity cache-poisoning finding has low confidence, while a high-confidence archived action and several top-level write permissions warrant modest workflow caution.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@datadog/js-core Version 0.0.16 | — | — |
@datadog/browser-core Version 7.15.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.