Blazing fast, zero configuration web application bundler
58%
Total Score
caution
Usable with caveats: three months without repository commits and workflow weaknesses raise maintenance and release-process risk.
The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance warning even though releases and a recent push are present.
The audit analyzed all six workflows and found no untrusted checkout or script-injection trigger, but all 49 action references are unpinned; high-confidence template-injection findings and high-confidence secrets inheritance in release workflows add release-process risk. The low-confidence cache findings are not decisive.
Issues and pull requests continue to be opened and closed, but no pull requests were merged in the last month, suggesting some maintenance throughput concerns.
The repository has no security policy, leaving vulnerability-reporting expectations and response guidance undocumented.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
nullthrows Version ^1.1.1 | — | — |
@parcel/utils Version 2.16.4 | — | — |
@parcel/logger Version 2.16.4 | — | — |
@parcel/profiler Version 2.16.4 | — | — |
@parcel/diagnostic Version 2.16.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.