Core components for Microsoft Bot Builder. Components in this library can run either in a browser or on the server.
20%
Total Score
critical
Unfit to use: the linked source repository is archived.
The repository recorded 0 commits and 0 active maintainers in the last 3 months, reinforcing the concern that development has stopped.
The linked Microsoft repository is archived, which is a severe abandonment risk even though it was pushed recently; archived projects should not be treated as actively maintained.
The package has a long history and 549 releases, but it had no releases in the last 12 months, indicating that its previously rapid cadence has ended.
There were no new or merged pull requests and no issue activity in the last month; this is consistent with the lack of recent commits, though open-issue data is unknown.
The project uses established TypeScript and build tooling, but the collected repository signal reports no security-scanning tools; this is a modest transparency gap, partly offset by the documented security policy and release notes describing security fixes.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10612 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. botbuilder-core is vulnerable to Path Traversal in versions 4.0.8 - 4.23.2. | 4.0.8 - 4.23.2 | High |
| Dependency | Last Release | Score |
|---|---|---|
zod Version ^3.23.8 | — | — |
uuid Version ^10.0.0 | — | — |
botbuilder-stdlib Version 4.23.3-internal | — | — |
botframework-schema Version 4.23.3 | — | — |
botframework-connector Version 4.23.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.