The repository has 230 commits from 21 active maintainers in three months, and the release has npm provenance. Its workflows leave all 19 actions unpinned, so pinning them would improve build hygiene.
87%
Total Score
90
100
94
88
100
Four of six publishing accounts use the project domain, but _bdbch publishes from bdbch.com, creating a minor account-hygiene concern despite the organization-backed project.
The repository name does not match this package and its README does not mention it, which is a caution because the linked repository may not clearly identify this package; the monorepo context partly explains the mismatch.
All 19 analyzed action references are unpinned, which weakens workflow reproducibility. The high-confidence template-injection and low-confidence-style package-install findings are hygiene concerns, but no untrusted checkout, script injection, or broad write permission was observed.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.