@sigstore/bundle
It includes types, a README, release notes, tests in the source tree, and no install-time scripts. Workflow review found two high-severity bot-condition concerns and two low-severity ad hoc package installs, but read-only permissions and fully pinned actions reduce exposure.
88%
Total Score
100
100
94
88
100
Health Score Breakdown
The package has existed for about three years with 13 releases, but only one release in the last 12 months; active repository work and a recent release partly compensate for the slower registry cadence.
All nine workflows were analyzed, all use read-only permissions, and all 32 action references are pinned. Two high-severity bot-condition findings and two high-confidence ad hoc package-install findings remain workflow hygiene concerns.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @sigstore/protobuf-specs Version ^0.5.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 months ago
- Created
- 3 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.