Package Health/@langchain/langgraph-checkpoint

@langchain/langgraph-checkpoint

Library with base interfaces for LangGraph checkpoint savers.

Latest 1.2.0

NPM

88%

Total Score

healthy

Frequent stable releases, active organization-backed development, and strong provenance outweigh a repository-package mismatch and workflow credential concern.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

A prepublish lifecycle script runs during publishing, adding some supply-chain surface, although no broader install-time script is shown.

Repo package mention

The repository name differs from the package name, which is ordinary for a monorepo, but the README does not mention this package; that weakens direct package-to-source transparency.

Workflow audit

All seven workflows were analyzed and all 40 action references are pinned, with no untrusted checkout or script-injection findings. The high-confidence use-trusted-publishing audit finding and top-level write permissions in three workflows leave a moderate workflow-hygiene concern.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-866673 @langchain/langgraph-checkpoint is vulnerable to Insecure Deserialization in versions 0.0.1 - 0.1.2 and 1.0.0 - 1.1.3.	0.0.1 - 0.1.21.0.0 - 1.1.3	High
AIKIDO-2026-555920 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @langchain/langgraph-checkpoint is vulnerable to Prototype Pollution in versions 0.0.1 - 1.0.2.	0.0.1 - 1.0.2	Medium

Package versions

Maintainers

lc-oss-admin

langchain-security

Direct Dependencies

No direct dependencies.

88%

Total Score

healthy

Frequent stable releases, active organization-backed development, and strong provenance outweigh a repository-package mismatch and workflow credential concern.

Are you affected? Scan for Free