@malloydata/malloy
Malloy is a modern open source language for describing data relationships and transformations. It is both a semantic modeling language and a querying language that runs queries against a relational database. Malloy currently connects to BigQuery and Postg
88%
Total Score
healthy
Healthy: frequent releases and active project maintenance outweigh workflow pinning gaps.
Health Score Breakdown
All 17 workflows were analyzed and all use read-only permissions, but all 47 action references are unpinned, three workflows use unpinned container images with high-confidence findings, release automation installs an ad hoc package, and prerelease publishing uses trusted publishing. The pull_request_target workflow also performs an untrusted checkout, so CI supply-chain hygiene warrants caution.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10257 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @malloydata/malloy is vulnerable to Use of Weak Hash in versions 0.0.1 - 0.0.337. | 0.0.1 - 0.0.337 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 uuid Version ^11.1.1 | — | — |
luxon Version ^3.7.2 | — | — |
assert Version ^2.0.0 | — | — |
lodash Version ^4.18.1 | — | — |
antlr4ts Version ^0.5.0-alpha.4 | — | — |
Weekly Downloads
Info
- Last Published
- 12 days ago
- Created
- 4 years ago
- Unpacked Size
- 4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.