React Server Components (RSC) support for Vite.
89%
Total Score
healthy
Frequent releases, active maintenance, and verified publishing outweigh minor workflow hygiene concerns.
The project uses Vite, SWC, TypeScript, and npm scripts, but no security scanning tool was detected; this is a modest transparency gap rather than a release blocker.
Although the package remains below major version 1, it is not prerelease and recent releases have had no prerelease share; the active cadence partly compensates for the unstable-major status.
All 11 workflows were analyzed with no high- or medium-severity findings and all action references pinned; the low-confidence hygiene finding concerns installing a package outside a lockfile, while trusted publishing is informational.
| Title | Versions | Severity |
|---|---|---|
CVE-2025-68155 @vitejs/plugin-rsc is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 0.5.8. | 0.0.0 - 0.5.8 | High |
CVE-2025-67489 @vitejs/plugin-rsc is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 0.5.5. | 0.0.0 - 0.5.5 | Critical |
| Dependency | Last Release | Score |
|---|---|---|
obug Version ^3.0.0 | — | — |
srvx Version ^1.0.5 | — | — |
vitefu Version ^1.1.3 | — | — |
magic-string Version ^1.4.3 | — | — |
turbo-stream Version ^3.2.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.