@orpc/client

Latest 1.15.7

88%

Total Score

healthy

Active, well-supported package with strong release and repository activity; workflow pinning and contributor concentration are the main cautions.

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

One contributor made about 85% of recent commits, creating concentration risk, but 16 contributors were active and the repository is organization-owned, providing meaningful backup capacity.

Version stability

The assessed release is a stable, non-prerelease version, although 65% of recent releases being prereleases adds some version-churn caution.

Workflow audit

All five workflows were analyzed with no untrusted checkouts or script-injection findings, but all 17 action references are unpinned and one high-confidence informational audit flagged trusted-publishing usage; the single top-level write workflow is not paired with an untrusted trigger.

Vulnerabilities

Title	Versions	Severity
CVE-2026-28794 @orpc/client is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 1.13.5.	0.0.0 - 1.13.5	Critical

Package versions

Maintainers

dinwwwh

Direct Dependencies

Dependency	Last Release	Score
@orpc/shared Version 1.15.7	—	—
@orpc/standard-server Version 1.15.7	—	—
@orpc/standard-server-peer Version 1.15.7	—	—
@orpc/standard-server-fetch Version 1.15.7	—	—