algoliasearch-helper

Helper for implementing advanced search features with algolia

Latest 3.30.0

NPM

82%

Total Score

healthy

Healthy; active releases and broad organizational maintenance outweigh workflow permission and pinning gaps.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

A prepare install-time script adds execution during installation, which increases review surface compared with a package without lifecycle scripts.

Security policy

No repository security policy was found, leaving vulnerability reporting guidance less clear for users and contributors.

Workflow audit

All 68 action references are unpinned, and five high-confidence github-app findings plus two secrets-inherit findings expose broader-than-needed workflow credentials; no untrusted checkout or script-injection trigger was found, so this is a caution rather than a severe health verdict.

Vulnerabilities

Title	Versions	Severity
CVE-2025-3193 algoliasearch-helper is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 2.0.0-rc1 - 3.11.2.	2.0.0-rc1 - 3.11.2	Medium
CVE-2021-23433 algoliasearch-helper is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in versions 0.0.0 - 3.6.2.	0.0.0 - 3.6.2	Critical