68%
Total Score
67
89
67
All recent repository commits came from one contributor, leaving current maintenance concentrated in a single person. Organization ownership provides some handoff capacity but does not remove the present concentration.
Only one commit was recorded in the last three months, indicating that source activity has recently slowed sharply despite the package's broader release history.
The repository name does not match this subpackage and its README does not mention the package, creating some uncertainty about package-to-source correspondence. The organization-owned monorepo structure partly explains the name mismatch but does not fully resolve the missing mention.
The repository uses TypeScript, Babel, and npm build tooling, showing an established build process, but no security-scanning tooling was detected.
No repository security policy was found, reducing disclosure transparency for a package that handles development-server functionality.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10854 @react-native-community/cli-server-api is vulnerable to Command Injection in versions 0.0.1 - 17.0.0, 18.0.0 - 18.0.0 and 19.0.0 - 19.1.1. | 0.0.1 - 17.0.018.0.0 - 18.0.019.0.0 - 19.1.1 | Critical |
| Dependency | Last Release | Score |
|---|---|---|
ws Version ^6.2.3 | — | — |
open Version ^6.2.0 | — | — |
connect Version ^3.6.5 | — | — |
nocache Version ^3.0.1 | — | — |
body-parser Version ^2.2.2 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.