@graphql-hive/signal
68%
Total Score
caution
Usable with caveats: the linked repository does not identify this package, and a high-confidence workflow issue remains.
Health Score Breakdown
The linked repository name does not match the package name and its README does not mention the package, so the association is not transparent and the repository may not directly belong to this release.
The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap for a maintained package.
Version 2.0.0 is a stable major release, but 95% of recent releases are prereleases, which makes the surrounding release stream unusually experimental.
All six workflows were analyzed successfully, with no untrusted checkout or script-injection counts and no top-level write permissions. However, the audit found one high-confidence template-injection issue in examples.yml, and 21 of 66 action references are unpinned.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 1 year ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.