Blazing fast, zero configuration web application bundler
64%
Total Score
caution
Usable with caveats: no commits in three months and all 49 workflow actions are unpinned.
No build provenance attestation or trusted-publisher identity is present, limiting release traceability. The package's long release history and organization backing provide some compensating context but not verifiable provenance.
The repository recorded zero commits and zero active maintainers in the last three months. Recent registry releases and a recent repository push soften this, but the lack of observed commit activity is a meaningful maintenance warning.
Issue and pull-request traffic continues, but no pull requests were merged in the last month while 150 remain open. This suggests slower repository throughput alongside the stronger release history.
The repository name does not match this package and its README does not mention the package. Although a monorepo mismatch is normal for subpackages, the missing README reference leaves package-to-repository ownership less explicit.
No repository security policy was found, leaving vulnerability reporting and disclosure expectations less transparent for consumers.
| Title | Versions | Severity |
|---|---|---|
CVE-2025-56648 @parcel/reporter-dev-server is vulnerable to Origin Validation Error in versions 1.6.1 - 2.16.3. | 1.6.1 - 2.16.3 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
@parcel/utils Version 2.16.4 | — | — |
@parcel/plugin Version 2.16.4 | — | — |
@parcel/codeframe Version 2.16.4 | — | — |
@parcel/source-map Version ^2.1.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.