@shikijs/engine-javascript
Engine for Shiki using JavaScript's native RegExp
82%
Total Score
healthy
Healthy release with active maintenance and provenance; unpinned workflows and unclear package-to-repository linkage are the main caveats.
Health Score Breakdown
The repository name does not match the package name and its README does not mention this package, so the package-to-repository relationship is not explicit; this is a caution even though a monorepo can legitimately contain subpackages.
The project uses established build and test tooling, including TypeScript, Vitest, and bundlers; no security-scanning tools were detected, leaving a modest hygiene gap.
The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.
All 13 analyzed action references are unpinned, and the audit found high-confidence adhoc package installs; the low-confidence cache finding is hygiene only. One workflow also grants top-level write permissions, though no untrusted checkout or script injection was found.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @shikijs/types Version 4.5.0 | — | — |
oniguruma-to-es Version ^4.3.6 | — | — |
@shikijs/vscode-textmate Version ^10.0.2 | — | — |
Weekly Downloads
Info
- Last Published
- 12 days ago
- Created
- 2 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.