@duckdb/node-api
An API for using [DuckDB](https://duckdb.org/) in [Node](https://nodejs.org/).
78%
Total Score
healthy
Healthy overall, supported by frequent releases and active repository work despite workflow and security-policy gaps.
Malware detected in 1 version
Health Score Breakdown
The repository has no published security policy. That is a transparency gap for a package that ships native database bindings, although active maintenance and provenance partly offset it.
The assessed version is a prerelease, and every recent version is marked prerelease, which adds some release-readiness uncertainty despite the stable major version.
The single workflow was fully analyzed and scopes permissions at the job level, but all 26 action references are unpinned and the audit found high-confidence template-injection and unpinned-image hygiene issues. No pull-request-target, workflow-run, untrusted checkout, or script-injection path was reported, so these findings do not independently indicate a severe dependency risk.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @duckdb/node-bindings Version 1.5.6-r.1 | — | — |
Weekly Downloads
Info
- Last Published
- 17 days ago
- Created
- 1 year ago
- Unpacked Size
- 0.7 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.