@firebase/ai
This release appears healthy and suitable to depend on, with strong evidence of active maintenance, organizational backing, mature repository practices, and frequent releases. The linked repository is active and unarchived, with 95 commits from 15 contributors in the last 3 months, while the package has 240 releases over 484 days and 136 releases in the last 12 months. It has clear Apache-2.0 licensing, TypeScript declarations, a substantial built artifact, no install-time lifecycle scripts, repository tests and changelog coverage, and no detected dangerous workflow patterns. The main reservations are absent build provenance attestation, no repository security-scanning tooling detected, several workflows without top-level permission declarations, and the repository not explicitly naming this package in its README; however, the latter is reasonably explained by the package being a component of the Firebase JS SDK monorepo, and the organization-owned repository provides substantial backing.
88%
Total Score
100
100
83
90
50
Health Score Breakdown
No build attestation, trusted publisher identity, or staged publishing evidence is present, leaving release-to-source provenance less transparent despite the package's otherwise strong repository and release activity.
The repository name does not match the package and its README does not mention @firebase/ai, which creates a package-to-repository transparency concern. However, the organization-owned Firebase JS SDK monorepo and the package README identifying it as a Firebase JS SDK component provide substantial compensating context.
The repository uses established build tooling including Nx, Rollup, Webpack, TypeScript, Babel, and npm scripts. No security-scanning tools were detected, which is a transparency gap but not by itself a severe health risk.
Sixteen workflows declare read-only permissions and none declare top-level write permissions, but five workflows lack top-level permissions declarations, leaving some least-privilege behavior less explicit.
Version 2.16.0 is a stable-major, non-prerelease release. Although 70% of recent releases are prereleases, the assessed version itself is stable, so this is only a minor maturity reservation.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 tslib Version ^2.1.0 | — | — |
@firebase/util Version 1.15.3 | — | — |
@firebase/logger Version 0.5.2 | — | — |
@firebase/component Version 0.7.5 | — | — |
@firebase/app-check-interop-types Version 0.3.5 | — | — |
Weekly Downloads
Info
- Last Published
- 27 days ago
- Created
- 1 year ago
- Unpacked Size
- 2.6 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.