Sign and unsign cookies
78%
Total Score
50
100
89
75
The package is mature, with 13 releases since October 2012, but it has had no release in the last 12 months. The quiet registry cadence is a maintenance caution, partly offset by the unarchived repository and recent push.
The repository recorded zero commits and zero active maintainers during the last three months. This indicates limited current development activity, although the package is mature and stable.
The repository reports no build tooling and no security-scanning tools. For this small dependency the build gap is minor, but the absence of security scanning reduces transparency.
No security policy was found in the repository. This is a transparency gap, though the package's small scope and zero runtime dependencies limit its practical weight.
| Title | Versions | Severity |
|---|---|---|
CVE-2016-1000236 cookie-signature is vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in versions 0.0.0 - 1.0.4. | 0.0.0 - 1.0.4 | Medium |
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.