@octokit/webhooks
GitHub webhook events toolset for Node.js
62%
Total Score
75
100
94
67
100
Health Score Breakdown
The audit completed all seven workflows and found five high-confidence github-app findings involving blanket installation permissions. In addition, 26 of 27 action references are unpinned; the absence of untrusted checkouts and script injection limits the overall severity but does not remove the workflow hygiene risk.
The package is mature, with 286 releases since November 2017, but only one release in the last 12 months despite a historical median interval of about 2.6 days; this indicates a materially slower recent cadence.
The repository recorded zero commits and zero active maintainers in the last three months, which is a concern for maintenance responsiveness; the recent push provides only limited compensation.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2023-50728 @octokit/webhooks is vulnerable to Improper Handling of Exceptional Conditions in versions 0.0.0 - 9.26.3, 10.0.0 - 10.9.2, 11.0.0 - 11.1.2 and 12.0.0 - 12.0.3. | 0.0.0 - 9.26.310.0.0 - 10.9.211.0.0 - 11.1.2 +1 more | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @octokit/request-error Version ^7.0.0 | — | — |
@octokit/webhooks-methods Version ^6.0.0 | — | — |
@octokit/openapi-webhooks-types Version 12.1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 10 months ago
- Created
- 8 years ago
- Unpacked Size
- 0.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.