The package is small and focused, with a clear README, TypeScript declarations, and only one runtime dependency. Its repository is actively maintained by many contributors and has security tooling, though workflow references are unpinned and publishing uses long-lived credentials.
82%
Total Score
100
100
100
88
All seven workflows were analyzed, but all 23 action references are unpinned, and two high-confidence template-injection findings appear in release preparation; the audit does not show an untrusted checkout or script-injection sink there. Top-level write permissions and long-lived-token publishing add workflow hygiene and supply-chain caution, while the low-confidence cache finding is minor.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@orval/core Version 8.39.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.