@firebase/data-connect
Type declarations, a clear license, and a substantial repository support integration and ongoing care. The package is still below a stable major version, and the repository does not explicitly identify this package in its README; one workflow also installs an ad hoc package.
86%
Total Score
100
100
89
88
50
Health Score Breakdown
No registry build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable despite the active project backing.
The linked monorepo neither matches the package name nor mentions it in its README, so the package-to-repository link is less explicit; the repository structure still shows Firebase package development.
Version 0.7.4 is not a prerelease, but the package remains below 1.0 and 70% of recent releases were prereleases, so API stability is less established.
All 21 workflows were analyzed, all 106 action references are pinned, and permissions are read-only or job-scoped. A high-severity cache-poisoning pattern had low confidence and is hygiene-level under the audit rules, while a high-confidence ad hoc package installation is a minor workflow concern.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 tslib Version ^2.1.0 | — | — |
@firebase/util Version 1.15.3 | — | — |
@firebase/logger Version 0.5.2 | — | — |
@firebase/component Version 0.7.5 | — | — |
@firebase/auth-interop-types Version 0.2.6 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 2 years ago
- Unpacked Size
- 1.8 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.