@powersync/web
PowerSync Web SDK
84%
Total Score
healthy
Healthy; frequent releases and active contributors outweigh workflow pinning and security-policy gaps.
Health Score Breakdown
The repository has no security policy, leaving vulnerability-reporting expectations unclear; this is a transparency gap, though it is offset somewhat by active development and scanning.
All 12 workflows were analyzed, but 45 of 46 action references are unpinned, and high-confidence template-injection findings plus ad hoc package installs weaken workflow hygiene. No untrusted checkout or injection trigger was found, limiting the severity.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2024-10440 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @powersync/web is vulnerable to Cleartext Transmission of Sensitive Information in versions 0.5.1 - 1.10.1. | 0.5.1 - 1.10.1 | Low |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 comlink Version ^4.4.2 | — | — |
commander Version ^12.1.0 | — | — |
@powersync/common Version 2.3.1 | — | — |
@journeyapps/wa-sqlite Version 2.0.6 | — | — |
@powersync/shared-internals Version 1.3.1 | — | — |
Weekly Downloads
Info
- Last Published
- 13 days ago
- Created
- 2 years ago
- Unpacked Size
- 9.8 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.