This native platform package is clearly part of a large, actively maintained project with frequent releases and strong contributor depth. The repository’s automation has several high-confidence credential-scope findings, so release workflows deserve attention despite otherwise strong safeguards.
84%
Total Score
100
93
83
100
The repository name does not match this platform-specific package and its README does not mention the package, which creates some identity ambiguity; the organization-owned monorepo context partly offsets that concern.
All 209 analyzed action references are pinned, most workflows use read-only permissions, and there are no untrusted checkouts or script injections. However, eight high-confidence github-app findings report blanket installation permissions, creating a real credential-scope hygiene concern in automation.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.