User-friendly query builder for React. Core
58%
Total Score
38
100
89
75
The repository recorded zero commits and zero active maintainers in the last 3 months. Together with no registry releases in the last year, this is the strongest maintenance concern.
Only one registry account has publish access. The repository is user-owned rather than organization-backed, so the narrow publisher base is a meaningful continuity risk.
The package namespace and repository are linked to the same user-owned project, providing coherent ownership context, but no organization backing is shown to compensate for the single publisher.
The package has 37 releases over about 3 years, but none in the last 12 months; the latest registry release was about 16 months ago. This materially raises staleness risk despite the earlier regular cadence.
There are 134 open issues and 28 open pull requests, with no issues or pull requests closed or merged in the last month. This suggests unresolved maintenance demand.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10312 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @react-awesome-query-builder/core is vulnerable to Prototype Pollution in versions 6.3.0 - 6.6.14. | 6.3.0 - 6.6.14 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
clone Version ^2.1.2 | — | — |
lodash Version ^4.17.21 | — | — |
moment Version ^2.30.1 | — | — |
i18next Version ^23.11.5 | — | — |
spel2js Version ^0.2.8 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.