@inrupt/solid-client-vc

A library to act as a client to a server implementing the W3C VC HTTP APIs.

Latest 2.0.1

NPM

72%

Total Score

caution

Usable with caveats: workflow hygiene and uncertain package-to-repository alignment limit confidence.

Are you affected? Scan for Free

Health Score Breakdown

Release history

The package has 210 releases since September 2021, but only 2 releases in the last 12 months; recent repository activity partly compensates for the slower registry cadence.

Repo package mention

The repository name does not match the package name and its README does not mention the package, so the linkage is not clearly established even though the repository is organization-owned.

Workflow audit

All six workflows were analyzed, but 19 of 23 action references are unpinned, two workflows grant top-level write access, and a high-severity cache-poisoning finding has low confidence while a high-confidence adhoc package install remains. These are workflow hygiene concerns rather than proof of unsafe release behavior.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10790 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @inrupt/solid-client-vc is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.2.0.	0.0.1 - 1.2.0	Low

Package versions

Maintainers

Direct Dependencies

Dependency	Last Release	Score
n3 Version ^1.21.0	—	—
md5 Version ^2.3.0	—	—
rdf-namespaces Version ^1.12.0	—	—
@inrupt/solid-client Version ^3.0.0	—	—
jsonld-context-parser Version ^3.0.0	—	—