@google/genai
[](https://www.npmjs.com/package/@google/genai) [](https://www.npmjs.com/package/@google/genai)
88%
Total Score
healthy
Frequent releases and active organization-backed maintenance outweigh unpinned workflow actions and install-time scripts.
Health Score Breakdown
The package defines preinstall, prepack, and prepare scripts. These can complicate installation and increase supply-chain exposure, although the signal does not show malicious behavior.
Two of three publishing accounts use google.com addresses, consistent with the organization-backed project; mrdoob (mrdoob.com) is an outside-domain publishing account, a limited account-hygiene caution.
All nine workflows were analyzed with no untrusted checkout or script-injection paths. However, all 18 action references are unpinned, one workflow has top-level write permissions, and a low-confidence cache-poisoning finding warrants workflow hygiene caution rather than a severe downgrade.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10482 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @google/genai is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.3.0 - 1.9.0. | 0.3.0 - 1.9.0 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ws Version ^8.18.0 | — | — |
p-retry Version ^4.6.2 | — | — |
protobufjs Version ^7.5.4 | — | — |
google-auth-library Version ^10.3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 days ago
- Created
- 1 year ago
- Unpacked Size
- 11.4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.