@genkit-ai/firebase
Genkit AI framework plugin for Firebase including Firestore trace/state store and deployment helpers for Cloud Functions for Firebase.
88%
Total Score
healthy
Healthy: frequent releases and active contributors outweigh workflow pinning and the missing security policy.
Health Score Breakdown
No build attestation or trusted-publisher provenance is present, leaving the registry artifact's build origin less independently verifiable despite the active organization-backed project.
The linked repository has no published security policy, reducing transparency about vulnerability reporting and response expectations.
All 19 workflows were analyzed without failures, and the pull_request_target workflow has no untrusted checkout or script-injection finding. However, 47 of 68 action references are unpinned and two workflows grant top-level write access; the low-confidence cache-poisoning finding is hygiene rather than a severe risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10651 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @genkit-ai/firebase is vulnerable to Race Condition in versions 0.0.1 - 0.9.0. | 0.0.1 - 0.9.0 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @genkit-ai/google-cloud Version ^1.42.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 2 years ago
- Unpacked Size
- 0.3 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.