@logtape/redaction

Redact sensitive data from log messages

Latest 2.4.1

72%

Total Score

caution

Active project with npm provenance, but 97% commit concentration, unpinned workflow actions, and weak package-to-repository identification add risk.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

A prepublish script is present, which adds publishing-process complexity, but prepublish is not an install-time consumer script and therefore is only a minor concern.

Repo bus factor

One contributor made 130 of 134 commits, or about 97%, so the project has a meaningful continuity risk even though two other contributors remained active.

Repo package mention

The repository name does not match the package and its README does not mention @logtape/redaction, so the package-to-source relationship is less transparent, although a monorepo can explain the name mismatch.

Workflow audit

All 26 action references are unpinned, which weakens build reproducibility. The audit also reported nine low-confidence cache-poisoning findings; because they are low confidence and no untrusted trigger or checkout sink was found, they remain hygiene concerns rather than severe risks.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10873 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @logtape/redaction is vulnerable to Insertion of Sensitive Information into Log File in versions 0.0.1 - 1.1.2 and 1.2.0 - 1.2.1.	0.0.1 - 1.1.21.2.0 - 1.2.1	Low