@google/gemini-cli-core
Gemini CLI Core
72%
Total Score
caution
Active Google-backed maintenance is offset by workflow risks and weak evidence that the linked repository directly belongs to this package.
Health Score Breakdown
No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than it could be.
The package declares 69 runtime dependencies, creating a relatively broad dependency surface for consumers, though the signal does not show abnormal or unsafe dependency behavior.
Two of three publishing accounts use the Google domain, consistent with the organization-backed project. The outside-domain account mrdoob (mrdoob.com) is an account-hygiene caution, not evidence of limited maintenance capacity.
The repository name does not match the package name and its README does not mention the package, so the link does not clearly establish that this repository directly owns the published package.
Version 0.63.0 is not a prerelease, but 85% of recent releases are prereleases and the package remains below 1.0, so API stability is a meaningful adoption concern.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ajv Version 8.17.1 | — | — |
fzf Version 0.5.2 | — | — |
zod Version 3.25.76 | — | — |
diff Version 8.0.3 | — | — |
fdir Version 6.4.6 | — | — |
Weekly Downloads
Info
- Last Published
- 6 days ago
- Created
- 1 year ago
- Unpacked Size
- 43.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.