@npmcli/config
Configuration management for the npm cli
82%
Total Score
healthy
Healthy: frequent releases and active organizational maintenance outweigh workflow hygiene gaps.
Health Score Breakdown
No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent. This is a supply-chain hygiene gap, not evidence that the release is malicious.
Four publishing accounts are present, including three on the primary github.com domain. martinrrm uses a gmail.com publishing address, which is an account-hygiene caution rather than evidence of limited maintenance capacity.
No type declarations are published, which is a minor integration gap for consumers using TypeScript, but it does not indicate abandonment or unsafe maintenance.
All 26 workflows were analyzed, with no untrusted checkout or script-injection findings. However, all 133 action references are unpinned, four workflows grant top-level write permissions, and high-confidence template-injection findings require workflow hygiene attention; the pull_request_target trigger has no reported untrusted sink.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ini Version ^7.0.0 | — | — |
nopt Version ^10.0.1 | — | — |
semver Version ^7.3.5 | — | — |
ci-info Version ^4.0.0 | — | — |
proc-log Version ^7.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 12 days ago
- Created
- 6 years ago
- Unpacked Size
- 0.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.