@shopify/shopify-api
Shopify API Library for Node - accelerate development with support for authentication, graphql proxy, webhooks
92%
Total Score
100
100
100
80
100
Health Score Breakdown
Three workflows use pull_request_target and one performs an untrusted checkout, creating workflow-review concerns even though no script injection was detected. These are repository automation risks rather than evidence that the published package is unfit.
Thirteen of 17 analyzed workflows lack top-level permission declarations, and two workflows have top-level write permissions. Although two workflows explicitly use read-only permissions and some permissions are job-scoped, this is a real least-privilege hygiene gap.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-76207 @shopify/shopify-api is vulnerable to Improper Verification of Cryptographic Signature in versions 7.6.0 - 13.1.0. | 7.6.0 - 13.1.0 | Medium |
AIKIDO-2026-591645 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @shopify/shopify-api is vulnerable to Improper Verification of Cryptographic Signature in versions 6.0.0 - 13.0.0. | 6.0.0 - 13.0.0 | Medium |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 jose Version ^5.9.6 | — | — |
isbot Version ^5.2.0 | — | — |
tslib Version ^2.8.1 | — | — |
lossless-json Version ^4.3.0 | — | — |
compare-versions Version ^6.1.1 | — | — |
Weekly Downloads
Info
- Last Published
- 20 days ago
- Created
- 5 years ago
- Unpacked Size
- 18.5 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.