Strong documentation, built-in types, repository tests, and organization backing support dependable use. The release remains active, but recent source activity and workflow pinning leave meaningful maintenance and build-hygiene concerns.
72%
Total Score
67
100
100
50
A prepare install-time script is present, so installation performs extra package-defined work. This is a modest build-hygiene concern, not evidence of abandonment by itself.
The repository recorded zero commits and zero active maintainers in the last three months. Frequent registry releases and a recent push partly offset this, but the recent source-activity gap remains significant.
There were four new pull requests in the last month, but no issues or pull requests were closed or merged, which weakens evidence of recent maintenance throughput.
No repository security policy was found, leaving vulnerability-reporting guidance and disclosure expectations unclear.
The workflow audit completed cleanly with read-only permissions and no dangerous findings, but all 16 action references are unpinned, leaving the build exposed to moving action revisions.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
@sinonjs/commons Version ^3.0.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.