@modern-js/runtime
A Progressive React Framework for modern web development.
86%
Total Score
healthy
Healthy release with strong maintenance and release evidence, tempered by package-identity and workflow-hygiene gaps.
Health Score Breakdown
The repository name does not match the package and its README does not mention @modern-js/runtime, so package identity is less transparent even though a monorepo can legitimately contain subpackages.
The project uses established build tooling, but no security-scanning tools were detected, leaving a modest security-process gap.
No repository security policy was detected, which reduces transparency for vulnerability reporting despite the repository's otherwise active maintenance.
All 10 workflows were analyzed with no untrusted checkout, script injection, high-severity finding, or unpinned action; six high-confidence low-severity findings install packages outside a lockfile, creating a limited reproducibility concern.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10130 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @modern-js/runtime is vulnerable to Cross-site Scripting (XSS) in versions 2.68.0 - 2.70.3. | 2.68.0 - 2.70.3 | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 isbot Version 3.8.0 | — | — |
cookie Version 0.7.2 | — | — |
entities Version ^7.0.1 | — | — |
react-is Version ^18.3.1 | — | — |
@swc/core Version 1.15.41 | — | — |
Weekly Downloads
Info
- Last Published
- 19 days ago
- Created
- 5 years ago
- Unpacked Size
- 1.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.