@pdfme/common
TypeScript base PDF generator and React base UI. Open source, developed by the community, and completely free to use under the MIT license!
88%
Total Score
healthy
Active releases and repository work support this package; workflow hygiene and the missing security policy are modest concerns.
Health Score Breakdown
The repository has no security policy, leaving vulnerability reporting and response expectations less transparent despite its active maintenance and Dependabot use.
All five workflows were analyzed, but all 14 action references are unpinned and one workflow has top-level write permissions. The two reported cache-poisoning findings are low-confidence hygiene warnings, with no untrusted checkout or script-injection sink, so this is a modest caution rather than a severe risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10455 @pdfme/common is vulnerable to Prototype Pollution in versions 5.2.0 - 5.4.0. | 5.2.0 - 5.4.0 | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 zod Version ^4.6.5 | — | — |
acorn Version ^8.18.0 | — | — |
buffer Version ^6.0.3 | — | — |
@pdfme/pdf-lib Version * | — | — |
Weekly Downloads
Info
- Last Published
- 21 hours ago
- Created
- 4 years ago
- Unpacked Size
- 0.7 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.