@voltagent/core

VoltAgent Core - AI agent framework for JavaScript

Latest 2.11.0

NPM

82%

Total Score

healthy

Healthy release with active maintenance, but high-confidence workflow findings and unpinned actions warrant caution.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All three workflows were analyzed without untrusted checkouts or script-injection findings, but the audit reports two high-confidence template-injection findings in pull-request.yml and all 37 action references are unpinned. These are concrete workflow supply-chain and CI-safety weaknesses despite job-level permissions in two workflows.

Build provenance

No build attestation or trusted-publisher provenance is present, leaving the relationship between the published artifact and its source less independently verifiable.

Dependency profile

The package declares 44 runtime dependencies across many providers, telemetry components, and integrations; this increases update and transitive-dependency complexity, though it fits the broad platform scope.

Repo tooling

The repository uses established TypeScript, testing, bundling, and build tools, but no security-scanning tooling was detected, leaving a modest hygiene gap.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10540 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @voltagent/core is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 0.1.76.	0.0.1 - 0.1.76	Medium