A clear license, provenance attestation, and consumer-facing README improve transparency. The source project has strong recent contribution activity and organizational backing, while workflow findings are limited to hygiene issues and the repository does not explicitly mention this package.
86%
Total Score
100
94
88
100
The linked monorepo name does not match this platform package and its README does not mention the package, leaving some uncertainty about the exact package-to-repository relationship; the organization and package namespace provide partial context but do not remove that gap.
All 15 workflows were analyzed, all 121 action references are pinned, and every workflow has read-only permissions. Medium-confidence template-injection warnings and high-confidence ad hoc package installs are real workflow hygiene concerns, but there are no untrusted checkouts, script injections, or high-severity findings.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.