@vendure/core

A modern, headless ecommerce framework

Latest 3.7.4

NPM

89%

Total Score

healthy

Healthy release with active maintenance and provenance; CI has a few contained hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package has 41 runtime dependencies, a substantial integration surface for a framework, but the profile is consistent with its broad ecommerce and GraphQL functionality.

Maintainers

The package has organization-backed publishing, but consumer_email_maintainers includes oliverstreissi (gmail.com), and outside_domain_maintainers includes michaelbromley (michaelbromley.co.uk) and dlhck (elevantiq.com); these are account-hygiene concerns partly offset by the vendure.io publisher domain.

Workflow audit

All 13 workflows were analyzed, references are fully pinned, and no untrusted checkout or script injection was found. High-confidence findings include an unpinned container image, an archived action, and ad hoc package installs; low-confidence cache findings are hygiene concerns only.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-755646 @vendure/core is vulnerable to Insecure Direct Object Reference (IDOR) in versions 0.0.1 - 3.7.1.	0.0.1 - 3.7.1	Medium
AIKIDO-2026-72996 @vendure/core is vulnerable to Observable Timing Discrepancy in versions 0.0.1 - 3.7.2.	0.0.1 - 3.7.2	Medium
AIKIDO-2026-686457 @vendure/core is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.3.0 - 3.6.4.	1.3.0 - 3.6.4	Medium
AIKIDO-2026-253906 @vendure/core is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.4.0 - 3.7.2.	1.4.0 - 3.7.2	Medium
AIKIDO-2026-692696 @vendure/core is vulnerable to Improper Authorization in versions 3.6.0 - 3.7.2.	3.6.0 - 3.7.2	Medium