convict

Featureful configuration management library for Node.js (nested structure, schema validation, etc.)

Latest 6.2.5

NPM

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. Although a recent package release and repository push provide some compensation, the lack of recent development is a real maintenance concern.

Repo issue activity

There were no new or closed issues and no new or merged pull requests in the last month, while 64 issues and 8 pull requests remain open. This indicates limited recent project activity.

Repo tooling

No build tools or security scanning tools were detected. The repository still has tests and a substantial source tree, but the absence of security scanning reduces maintenance transparency.

Security policy

No security policy was found in the repository. This does not prove unsafe code, but it leaves vulnerability reporting and response expectations unclear.

Vulnerabilities

Title	Versions	Severity
CVE-2026-33864 convict is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 6.2.4.	0.0.0 - 6.2.4	Critical
CVE-2026-33863 convict is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 6.2.4.	0.0.0 - 6.2.4	Critical
CVE-2023-0163 convict is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 6.2.4.	0.0.0 - 6.2.4	High
CVE-2022-21190 convict is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 6.2.3.	0.0.0 - 6.2.3	Critical
CVE-2022-22143 convict is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 6.2.3.	0.0.0 - 6.2.3	High