@salesforce/core
Core libraries to interact with SFDX projects, orgs, and APIs.
86%
Total Score
healthy
Active Salesforce-backed maintenance and verified publishing outweigh workflow hygiene concerns.
Health Score Breakdown
Four publishing accounts use the Salesforce domain, and the repository is organization-owned, which supports continuity. The gmail.com, mobify.com, and lwcjs.org publishing accounts are account-hygiene cautions, not evidence of limited maintenance capacity.
All 9 workflows were analyzed with no untrusted checkouts or script injection, but 23 of 24 action references are unpinned and five high-confidence secrets-inherit findings pass credentials to reusable workflows. These are meaningful release-automation hygiene risks, though none is severe on its own.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-55673 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @salesforce/core is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.16.10 - 8.32.2. | 0.16.10 - 8.32.2 | Medium |
AIKIDO-2026-10220 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @salesforce/core is vulnerable to Insertion of Sensitive Information into Log File in versions 0.0.1 - 8.25.1. | 0.0.1 - 8.25.1 | Low |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ajv Version ^8.18.0 | — | — |
zod Version ^4.1.12 | — | — |
faye Version ^1.4.1 | — | — |
pino Version ^9.7.0 | — | — |
jszip Version 3.10.1 | — | — |
Weekly Downloads
Info
- Last Published
- 4 days ago
- Created
- 8 years ago
- Unpacked Size
- 1.4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.