@microsoft/signalr
ASP.NET Core SignalR Client
91%
Total Score
100
95
83
50
Health Score Breakdown
No registry build attestation or trusted-publisher provenance is reported, leaving publication-to-source verification weaker than it could be despite the strong maintenance evidence.
The linked repository name does not match the package name and its README does not mention @microsoft/signalr, which makes the package-to-repository relationship less transparent. The organization-owned monorepo context partly explains the mismatch but does not remove the documentation gap.
All 20 workflows were analyzed without failed files, untrusted checkouts, or script injection. Eight workflows have top-level write permissions and two high-confidence low-severity adhoc-package findings, but no untrusted path reaches those permissions.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ws Version ^7.5.10 | — | — |
node-fetch Version ^2.6.7 | — | — |
eventsource Version ^2.0.2 | — | — |
fetch-cookie Version ^2.0.3 | — | — |
abort-controller Version ^3.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 7 years ago
- Unpacked Size
- 2.8 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.