A native C++ Node module for querying and subscribing to filesystem events. Used by Parcel 2.
73%
Total Score
caution
Usable with caveats: active maintenance is offset by unpinned CI actions and an unclear package-to-repository match.
The repository name does not match this platform package and its README does not mention it, creating uncertainty about package ownership. The organization context and README link to the broader watcher project provide partial context but do not remove the gap.
The project uses established build tooling, but no security-scanning tool was detected. This is a modest transparency gap rather than evidence of abandonment.
The repository has no security policy. That weakens vulnerability-reporting transparency, though it is not by itself evidence that the release is unsafe.
All 21 analyzed action references are unpinned, and the high-confidence trusted-publishing finding indicates long-lived registry credentials; these are meaningful CI supply-chain hygiene concerns. No dangerous triggers, untrusted checkouts, or script injections were found, and the cache findings were low confidence.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.