@reduxjs/toolkit
The official, opinionated, batteries-included toolset for efficient Redux development
89%
Total Score
healthy
Healthy: years of releases and active organization-backed development outweigh minor workflow and security-policy gaps.
Health Score Breakdown
The project uses established build tools including TypeScript and npm scripts, but no security scanning tools were detected, leaving a modest transparency gap.
The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.
All six workflows were analyzed with no untrusted checkout or script-injection findings and all 50 action references pinned. High-confidence ad hoc package installs and two workflows with top-level write permissions are hygiene concerns, while the trusted-publishing finding is partly offset by the release's provenance attestation.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10755 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @reduxjs/toolkit is vulnerable to Exposure of Resource to Wrong Sphere in versions 2.9.0 - 2.9.1. | 2.9.0 - 2.9.1 | High |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 immer Version ^11.0.0 | — | — |
redux Version ^5.0.1 | — | — |
reselect Version ^5.1.0 | — | — |
redux-thunk Version ^3.1.0 | — | — |
@standard-schema/spec Version ^1.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 13 days ago
- Created
- 6 years ago
- Unpacked Size
- 6.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.