@langchain/community

Third-party integrations for LangChain.js

Latest 1.1.29

NPM

12%

Total Score

Maintainer Stability

Maturity

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Registry deprecation

NPM marks the entire package as deprecated, and the release notes say the community package is being sunsetted; no replacement package is provided.

Repo commit activity

The repository had zero commits and zero active maintainers during the last three months, consistent with the package’s sunset status.

Repository archived

The linked repository is archived, which is a severe abandonment signal even though it was pushed recently.

Workflow audit

All six workflows were analyzed with no untrusted checkout or script-injection findings, and 20 of 20 action references are pinned. A high-confidence template-injection finding and one workflow with top-level write permissions remain hygiene concerns.

Vulnerabilities

Title	Versions	Severity
CVE-2026-27795 @langchain/community is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.0 - 1.1.17.	0.0.0 - 1.1.17	Medium
CVE-2026-26019 @langchain/community is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.0 - 1.1.13.	0.0.0 - 1.1.13	Medium
CVE-2024-7042 @langchain/community is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 0.0.0 - 0.3.3.	0.0.0 - 0.3.3	Medium