68%
Total Score
caution
Usable with caveats: repository commits stopped for three months despite ongoing release and pull-request activity.
The repository records zero commits and zero active maintainers over the last three months, a meaningful maintenance warning despite recent releases and pull-request merges.
No repository security policy was found, leaving vulnerability reporting guidance unclear for a package that documents and addresses security-sensitive behavior.
All four workflows were analyzed with no high-confidence audit findings or untrusted checkout and injection sinks, but all 12 action references are unpinned and one workflow has top-level write permissions, weakening build reproducibility and least privilege.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-102829 New @simple-git/argv-parser is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 2.0.1. | 0.0.0 - 2.0.1 | Critical |
AIKIDO-2026-455143 New @simple-git/argv-parser is vulnerable to Command Injection in versions 0.0.1 - 2.0.0. | 0.0.1 - 2.0.0 | High |
| Dependency | Last Release | Score |
|---|---|---|
@simple-git/args-pathspec Version ^1.0.4 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.