Package Health

@vitejs/plugin-rsc

React Server Components (RSC) support for Vite.

Latest 0.5.38NPMNPM

89%

Total Score

healthy

Frequent releases, active maintenance, and verified publishing outweigh minor workflow hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Repo toolingcaution

The project uses Vite, SWC, TypeScript, and npm scripts, but no security scanning tool was detected; this is a modest transparency gap rather than a release blocker.

Version stabilitycaution

Although the package remains below major version 1, it is not prerelease and recent releases have had no prerelease share; the active cadence partly compensates for the unstable-major status.

Workflow auditcaution

All 11 workflows were analyzed with no high- or medium-severity findings and all action references pinned; the low-confidence hygiene finding concerns installing a package outside a lockfile, while trusted publishing is informational.

Vulnerabilities

TitleVersionsSeverity
CVE-2025-68155
@vitejs/plugin-rsc is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 0.5.8.
0.0.0 - 0.5.8
High
CVE-2025-67489
@vitejs/plugin-rsc is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 0.5.5.
0.0.0 - 0.5.5
Critical

Package versions

Maintainers

Direct Dependencies

DependencyLast ReleaseScore
obug
Version ^3.0.0
—
—
srvx
Version ^1.0.5
—
—
vitefu
Version ^1.1.3
—
—
magic-string
Version ^1.4.3
—
—
turbo-stream
Version ^3.2.1
—
—

Weekly Downloads

Info

Last Published
23 hours ago
Created
1 year ago
Unpacked Size
2.2 MB

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform