A Promise-based interface into processes created by child_process.spawn
82%
Total Score
80
100
94
63
A prepare script runs during installation, adding some install-time execution surface, although this is consistent with a package that builds or prepares compiled output.
All three-month commit activity comes from one contributor, creating concentration risk; organization ownership provides some capacity to hand maintenance off.
Only one commit was recorded in the last three months, which indicates light recent development but not abandonment given the recent release and repository activity.
The repository uses TypeScript and npm build tooling, but no security scanning tools were detected, leaving a modest security-process gap.
No repository security policy was found, reducing disclosure transparency for security issues, though this is not evidence of an unsafe release by itself.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10944 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @expo/spawn-async is vulnerable to Denial of Service in versions 1.2.8 - 1.7.2. | 1.2.8 - 1.7.2 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
cross-spawn Version ^7.0.6 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.