This is a healthy, mature release with strong evidence of ongoing maintenance and organizational backing. The package has existed for 2870 days, published 68 releases in the last 12 months, and is not deprecated; its stable major release is supported by a substantial README, MIT licensing, type declarations, reproducible-looking build outputs, and a linked Microsoft-owned repository that is actively pushed. Repository activity shows 17 commits from three active maintainers in the last three months, 13 issues closed, and 12 pull requests merged, with CI, Dependabot, CodeQL, a security policy, and no analyzed dangerous workflow patterns. The main reservations are absent build provenance attestations, a high recent prerelease share despite this stable release, concentrated commit activity with one contributor responsible for 80% of recent commits, and some GitHub Actions workflows with broad write permissions. These are meaningful hygiene and resilience concerns but do not outweigh the package's release history, active repository, tests in source, and Microsoft organizational backing.
91%
Total Score
90
100
95
90
50
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@nevware21/ts-async Version >= 0.5.5 < 0.6.0 | — | — |
@nevware21/ts-utils Version >= 0.14.0 < 2.x | — | — |
@microsoft/dynamicproto-js Version ^2.0.3 | — | — |
@microsoft/applicationinsights-shims Version 3.0.1 | — | — |
@microsoft/applicationinsights-core-js Version 3.4.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.