class-transformer

Proper decorator-based transformation / serialization / deserialization of plain javascript objects to class constructors

Latest 0.5.1

NPM

62%

Total Score

Maintainer Stability

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Dangerous workflows

One of four workflows uses pull_request_target, which warrants some workflow review, but no untrusted checkout or script-injection patterns were detected.

Release history

The package has 31 releases and a long history, but its latest release was in November 2021 with no releases in the last 12 months, indicating a substantially stale published version.

Repo commit activity

There were zero commits and zero active maintainers in the last three months. This is the clearest maintenance concern, although the repository is not archived and has a long project history.

Repo issue activity

The repository has 209 open issues and 59 open pull requests, but recorded new or closed issues and pull requests were all zero in the last month, suggesting limited issue maintenance.

Security policy

No repository security policy was found, leaving vulnerability-reporting guidance unclear.

Vulnerabilities

Title	Versions	Severity
CVE-2020-7637 class-transformer is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in versions 0.0.0 - 0.3.1.	0.0.0 - 0.3.1	Medium