@medusajs/medusa
Building blocks for digital commerce
86%
Total Score
healthy
Healthy release with strong maintenance evidence, though workflow security hygiene is a notable caveat.
Health Score Breakdown
The package has 71 runtime dependencies, including many related Medusa modules. This is substantial integration surface and adds upgrade complexity, but it is consistent with a full commerce platform package rather than an unexplained dependency burden.
The audit analyzed only 30 of 42 workflows and found 125 of 142 action references unpinned, along with high-confidence blanket GitHub App permissions and template-injection patterns. No untrusted checkout or script-injection sink was found, so these are workflow hygiene and containment concerns rather than a standalone severe health verdict.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10132 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @medusajs/medusa is vulnerable to Insertion of Sensitive Information into Log File in versions 1.0.0 - 2.5.1. | 1.0.0 - 2.5.1 | Low |
AIKIDO-2025-10032 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @medusajs/medusa is vulnerable to Information Disclosure in versions 1.17.0 - 1.20.10. | 1.17.0 - 1.20.10 | Medium |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 qs Version ^6.15.2 | — | — |
uuid Version ^11.1.1 | — | — |
boxen Version ^5.0.1 | — | — |
chalk Version ^4.1.2 | — | — |
multer Version ^2.3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 14 days ago
- Created
- 6 years ago
- Unpacked Size
- 3.5 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.