@fedify/fedify
An ActivityPub server framework
80%
Total Score
healthy
Active maintenance and provenance are strong, but nearly all CI action references are unpinned.
Health Score Breakdown
A prepublish lifecycle script is present. This is a limited supply-chain consideration, but the signal does not show a more concerning install-time script.
The project uses npm scripts and TypeScript for builds and has a security policy, but no security scanning tools were detected, leaving a modest process gap.
All nine workflows were analyzed with no failed files or untrusted checkouts, but 52 of 53 action references are unpinned and the audit found high-confidence template-injection and unpinned-image findings. The pull_request_target trigger is not paired with a reported untrusted checkout or script-injection sink.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-11096 @fedify/fedify is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 1.9.11 and 1.10.0 - 1.10.10. | 0.0.1 - 1.9.111.10.0 - 1.10.10 | Medium |
CVE-2026-42462 @fedify/fedify is vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in versions 2.2.0 - 2.2.3, 2.1.0 - 2.1.14, 2.0.0 - 2.0.18, 1.10.0 - 1.10.10 and 0.0.0 - 1.9.11. | 0.0.0 - 1.9.111.10.0 - 1.10.102.0.0 - 2.0.18 +2 more | High |
CVE-2026-34148 @fedify/fedify is vulnerable to Uncontrolled Resource Consumption in versions 0.0.0 - 1.9.6, 1.10.0 - 1.10.5, 2.0.0 - 2.0.8 and 2.1.0 - 2.1.0. | 0.0.0 - 1.9.61.10.0 - 1.10.52.0.0 - 2.0.8 +1 more | High |
AIKIDO-2026-10317 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @fedify/fedify is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 1.10.3. | 0.0.1 - 1.10.3 | Medium |
CVE-2025-68475 @fedify/fedify is vulnerable to Inefficient Regular Expression Complexity in versions 0.0.0 - 1.6.13, 1.7.0 - 1.7.14, 1.8.0 - 1.8.15 and 1.9.0 - 1.9.2. | 0.0.0 - 1.6.131.7.0 - 1.7.141.8.0 - 1.8.15 +1 more | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 jsonld Version ^9.0.0 | — | — |
devalue Version ^5.8.1 | — | — |
es-toolkit Version 1.46.1 | — | — |
json-canon Version ^1.0.1 | — | — |
@fedify/vocab Version 2.4.4 | — | — |
Weekly Downloads
Info
- Last Published
- 3 days ago
- Created
- 2 years ago
- Unpacked Size
- 5.4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.