bestzip
The package has a clear README, repository tests, an MIT license, and reproducible npm provenance. Its active project work is concentrated in one contributor, and the repository lacks security scanning and a security policy.
82%
Total Score
83
100
94
83
100
Health Score Breakdown
All 36 recent commits came from one contributor, with a 100% top-contributor share; this creates a real continuity risk for a user-owned project.
The project uses npm scripts, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.
The repository has no security policy, which makes vulnerability reporting and disclosure expectations less clear.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-761465 bestzip is vulnerable to Argument Injection in versions 0.0.1 - 2.2.5 and 3.0.0 - 3.0.1. | 0.0.1 - 2.2.53.0.0 - 3.0.1 | High |
CVE-2020-7730 bestzip is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 2.1.7. | 0.0.0 - 2.1.7 | Critical |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 glob Version ^13.0.6 | — | — |
yargs Version ^16.2.0 | — | — |
archiver Version ^8.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 5 days ago
- Created
- 11 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.