@flowfuse/flowfuse
An open source low-code development platform
79%
Total Score
healthy
Active releases and broad project activity outweigh workflow permission and pinning gaps.
Health Score Breakdown
No build attestation or trusted-publisher identity is present, leaving publication provenance less independently verifiable despite the package's strong release and repository activity.
Seventy-three runtime dependencies make the application dependency surface broad and increase update and transitive-risk overhead, though this is proportionate to the platform's scope.
All 10 workflows were analyzed with no untrusted checkouts or script injections, but high-confidence blanket GitHub App permissions were found in several workflows. The 18 of 76 unpinned actions and low-confidence cache finding are lesser hygiene concerns, not standalone severe risks.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10761 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @flowfuse/flowfuse is vulnerable to Insufficiently Protected Credentials in versions 2.20.0 - 2.23.0. | 2.20.0 - 2.23.0 | Low |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 pg Version ^8.11.3 | — | — |
vue Version ^3.4.5 | — | — |
zod Version ^4.4.3 | — | — |
diff Version ^9.0.0 | — | — |
mqtt Version ^5.16.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 days ago
- Created
- 2 years ago
- Unpacked Size
- 36.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.