@nx/web

@nx/web 23.2.1 presents a very strong dependency-health profile: it is actively released, not deprecated, backed by an unarchived organization-owned repository, and has substantial recent commit, issue, and pull-request activity across 42 active contributors. The package is MIT-licensed, includes type declarations, uses npm build provenance, has no install-time lifecycle scripts, and is supported by repository tests, changelog, security scanning, and a security policy. The main caution is that the linked monorepo neither matches the package name nor mentions it in its README, and several workflows lack top-level permission declarations; these are transparency and CI-hygiene concerns but are moderated by the clear Nx monorepo context, active project backing, and absence of analyzed dangerous workflow patterns.

Latest 23.2.1

NPM

92%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

100

Health Score Breakdown

Repo package mention

The linked repository name does not match @nx/web and its README does not mention the package, creating a transparency caution. The mismatch is nevertheless consistent with a package housed in the Nx monorepo, so it is not evidence of abandonment.

Token permissions

Six workflows lack top-level permissions declarations and one workflow has top-level write permissions, which is a CI permission-hygiene concern. However, six workflows explicitly use read-only permissions and the dangerous-workflow analysis found no exploit-prone workflow patterns.