This is a very healthy release to depend on: it has a long release history spanning nearly 10 years, 199 releases, 10 releases in the last 12 months, a stable non-prerelease version, and no registry deprecation. The linked Google-owned repository is active and unarchived, with 402 commits and 26 active maintainers in the last 3 months, broad contributor participation, extensive tests and changelog coverage in the repository, build and security tooling, and a security policy. The artifact includes an Apache-2.0 license, type declarations, and a substantial README. The main residual concerns are the single registry publishing account, absent build provenance attestation, an install-time prepare script, and one workflow with elevated write permissions, but these are outweighed by strong organizational backing and observable maintenance activity.
94%
Total Score
100
100
100
70
50
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
mime Version ^3.0.0 | — | — |
gaxios Version ^6.0.2 | — | — |
p-limit Version ^3.0.1 | — | — |
duplexify Version ^4.1.3 | — | — |
async-retry Version ^1.3.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.