@genkit-ai/tools-common

Healthy and suitable to depend on. It has frequent releases, active organizational backing, strong repository activity, tests, and clear licensing; the main caveats are missing build provenance, no security policy, and broad workflow permissions.

Latest 1.43.0

NPM

86%

Total Score

Maintainer Stability

100

Dependencies

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation, trusted publisher identity, or staged publishing is present. The active repository and controlled release workflows provide some context, but they do not compensate for the missing direct provenance of this artifact.

Dangerous workflows

One of 19 workflows uses pull_request_target, but there are no untrusted checkouts or script-injection findings. The isolated workflow pattern is a limited concern rather than a severe project-health issue.

Dependency profile

The package declares 28 runtime dependencies, including substantial server, validation, and utility functionality. This is a meaningful dependency surface to maintain, but the provided signals show no specific dependency failure or instability.

Repo package mention

The repository name does not match the package and its README does not mention this exact package, which can make package ownership less transparent. The matching organization namespace and monorepo-style repository context reduce, but do not eliminate, that concern.

Security policy

The repository has no published security policy. This weakens vulnerability-reporting transparency for a project with a broad runtime dependency and server-related surface.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-745297 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @genkit-ai/tools-common is vulnerable to Path Traversal in versions 0.9.0 - 1.39.0.	0.9.0 - 1.39.0	Medium