62%
Total Score
caution
More than 11,000 releases in under 16 months and a 95% recent prerelease share make this release history hard to assess.
No build attestation is present, so the published artifact's connection to its build process is not independently verified. The GitHub trusted-publisher identifier is a partial positive but does not replace an attestation.
The published artifact has no README, tests, or changelog. Tests and changelogs are normal source-repository contents, but a missing README is a real consumer-facing documentation gap for an SDK.
The package is 473 days old with 11,793 releases, including 11,590 in the last 12 months and a median interval of about 22 minutes. This shows activity but the unusually rapid cadence weakens confidence in release maturity.
Version 1.19.0 is a stable, non-prerelease major release, but 95% of recent releases were prereleases. That unusually high prerelease share makes the release stream less predictable.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
cross-spawn Version 7.0.6 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.