@uppy/companion

OAuth helper and remote fetcher for Uppy's (https://uppy.io) extensible file upload widget with support for drag&drop, resumable uploads, previews, restrictions, file processing/encoding, remote providers like Dropbox and Google Drive, S3 and more :dog:

Latest 7.1.1

NPM

91%

Total Score

healthy

Healthy release backed by active development, regular releases, and an unarchived organization-owned repository.

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package has 37 runtime dependencies, creating a comparatively broad maintenance and update surface. This is a modest complexity concern, not evidence of abandonment by itself.

Workflow audit

All six workflows were analyzed with no untrusted checkout or script-injection findings. However, 28 of 39 action references are unpinned, one workflow grants top-level write access, and high-confidence adhoc package installs bypass a lockfile, so workflow hygiene warrants caution.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10315 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @uppy/companion is vulnerable to AES Key Wear-out in versions 0.0.1 - 5.6.0.	0.0.1 - 5.6.0	Low
CVE-2022-0528 @uppy/companion is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 3.3.1.	0.0.0 - 3.3.1	High
CVE-2020-8135 @uppy/companion is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.0 - 1.9.3.	0.0.0 - 1.9.3	Critical
CVE-2020-8205 @uppy/companion is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.0 - 1.13.2 and 2.0.0-alpha.0 - 2.0.0-alpha.4.	0.0.0 - 1.13.22.0.0-alpha.0 - 2.0.0-alpha.4	High