87%
Total Score
healthy
Healthy release with strong maintenance and provenance, tempered by broad workflow tokens and an unclear package-to-repository link.
The repository name does not match the package and its README does not mention @oxlint/linux-x64-gnu, so the package-to-repository relationship is not explicit even though an organization-owned monorepo can legitimately publish subpackages.
All 206 analyzed action references are pinned, permissions are read-only in 28 workflows, and no untrusted checkout or script injection was found. However, eight high-confidence findings report GitHub App tokens inheriting blanket installation permissions, creating a meaningful workflow credential-hygiene concern.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.