This is a healthy, actively maintained release with strong organizational backing, frequent releases, recent repository activity, broad contributor participation, stable versioning, minimal runtime dependencies, bundled type declarations, licensing, npm provenance, and no deprecation or install-time scripts. The main transparency concern is that the linked monorepo neither matches the package name nor mentions it in its README, which warrants verification that the repository is the intended source; repository tests, changelog, releases, security policy, and controlled workflow permissions otherwise provide substantial compensating evidence.
91%
Total Score
100
100
90
100
100
The repository name does not match the package name and its README does not mention the package, so the package-to-source relationship is not directly demonstrated; although a monorepo name mismatch is ordinary, the absence of both indicators warrants caution.
The repository reports no detected build or security scanning tools, leaving a tooling and security-process gap despite other repository hygiene signals.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-72925 @swc/html is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.15.47-nightly-20260729.1. | 0.0.0 - 1.15.47-nightly-20260729.1 | Medium |
AIKIDO-2026-751689 @swc/html is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.5 - 1.15.46. | 0.0.5 - 1.15.46 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
@swc/counter Version ^0.1.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.