botbuilder

Bot Builder is a framework for building rich bots on virtually any platform.

Latest 4.23.3

NPM

18%

Total Score

critical

Unfit to use: the linked repository is archived.

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

The repository recorded zero commits and zero active maintainers over the past three months, reinforcing the abandonment risk shown by its archived status.

Repository archived

The linked Microsoft repository is archived, despite a last push in January 2026; archived source indicates the project is no longer an active maintenance target.

Build provenance

This release has no build attestation or trusted-publisher provenance, leaving publication origin less transparent than it could be for a widely used library.

Release history

The package has a long history and 645 releases, but it has had no releases in the last 12 months and its latest release was over a year before collection, indicating a serious maintenance gap.

Workflow audit

All 25 analyzed action references are unpinned, and one high-confidence low-severity finding reports an ad hoc package installation outside a lockfile; these are workflow hygiene concerns, not a standalone severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10613 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. botbuilder is vulnerable to Generation of Error Message Containing Sensitive Information in versions 4.7.0 - 4.23.2.	4.7.0 - 4.23.2	Low