A compat App Check package for new firebase packages
88%
Total Score
100
88
83
The repository name differs from the package name, which is normal for a monorepo, but its README does not mention this package. That weakens package-specific traceability, although the firebase organizational backing compensates substantially.
Version 0.4.7 is not a prerelease, but 75% of recent releases were prereleases and the package remains below major version 1, so its API maturity is somewhat limited.
All 21 workflows were analyzed, all 106 action references are pinned, and there are no untrusted checkouts or script injections. A high-confidence low-severity finding reports an ad hoc package installation outside a lockfile, which is a minor reproducibility concern; the low-confidence cache finding is hygiene rather than a demonstrated exploit.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
tslib Version ^2.1.0 | — | — |
@firebase/util Version 1.15.3 | — | — |
@firebase/logger Version 0.5.2 | — | — |
@firebase/app-check Version 0.13.1 | — | — |
@firebase/component Version 0.7.5 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.