conventional-changelog-conventionalcommits
It also ships with ISC licensing, bundled typings, a README, and a single runtime dependency. GitHub Actions use unpinned references, but the audit found no untrusted checkouts, injection paths, or other findings.
91%
Total Score
100
100
94
75
100
Health Score Breakdown
The project uses build tooling and npm scripts, but no security scanning tools were detected; this is a modest transparency gap rather than a dependency-blocking concern.
No repository security policy was detected, leaving vulnerability-reporting expectations undocumented; this is a minor transparency gap.
All five workflows were analyzed with no audit findings, untrusted checkouts, or injection paths. However, all 37 action references are unpinned and one workflow grants top-level write permissions, so workflow supply-chain hygiene is weaker even without an observed dangerous path.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @conventional-changelog/template Version ^1.4.0 | — | — |
Weekly Downloads
Info
- Last Published
- 3 hours ago
- Created
- 7 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.