@slack/bolt
A framework for building Slack apps, fast.
94%
Total Score
100
100
100
80
100
Health Score Breakdown
The package uses a prepare install lifecycle script, which adds installation-time execution and should be understood before adopting it, though this signal alone is not evidence of poor maintenance.
All 5 workflows omit top-level permissions declarations, and none declares read-only permissions; while no workflow has top-level write permissions, explicit least-privilege configuration is still a hygiene gap.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10973 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @slack/bolt is vulnerable to Improper Authentication in versions 1.0.0 - 4.7.2. | 1.0.0 - 4.7.2 | High |
AIKIDO-2026-10701 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @slack/bolt is vulnerable to Improper Authentication in versions 1.0.0 - 4.7.1. | 1.0.0 - 4.7.1 | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 tsscmp Version ^1.0.6 | — | — |
express Version ^5.0.0 | — | — |
raw-body Version ^3 | — | — |
@slack/oauth Version ^4.0.0 | — | — |
@slack/types Version ^3.1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 7 years ago
- Unpacked Size
- 0.6 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.