Package Health

@react-email/editor

A rich text editor for editing and building email templates

Latest 1.7.12NPMNPM

88%

Total Score

healthy

Frequent releases and broad contributor activity support a dependable package despite type and workflow hygiene gaps.

Are you affected? Scan for Free

Health Score Breakdown

Dependency profilecaution

The package declares 32 runtime dependencies, including many editor and Tiptap components; this is substantial coupling for a library, though it fits the rich editor functionality described by the package.

Repo toolingcaution

The project uses TypeScript, Vitest, Turbo, Rollup, and Vite, providing a structured build and test toolchain; no security scanning tool was detected, which is a minor gap.

Type declarationscaution

The indicator reports no type declarations for a React and TypeScript-oriented library, which can make integration less safe and ergonomic for consumers.

Workflow auditcaution

All 11 workflows were analyzed and all 24 action references are pinned, but the audit found a high-confidence template-injection issue and an informational trusted-publishing finding; one workflow also has top-level write permissions.

Vulnerabilities

TitleVersionsSeverity
AIKIDO-2026-180874 Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
@react-email/editor is vulnerable to Prototype Pollution in versions 1.0.0 - 1.4.7.
1.0.0 - 1.4.7
Medium
AIKIDO-2026-54895 Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
@react-email/editor is vulnerable to Cross-Site Scripting (XSS) in versions 1.0.0 - 1.5.1.
1.0.0 - 1.5.1
Medium

Package versions

Direct Dependencies

DependencyLast ReleaseScore
prismjs
Version ^1.30.0
—
—
@tiptap/pm
Version ^3.17.1
—
—
react-email
Version 6.11.1
—
—
@tiptap/core
Version ^3.17.1
—
—
@tiptap/html
Version ^3.17.1
—
—

Weekly Downloads

Info

Last Published
1 day ago
Created
7 months ago
Unpacked Size
1.6 MB

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform