Cross platform child_process#spawn and child_process#spawnSync
72%
Total Score
75
100
88
67
50
No build attestation or staged publishing evidence was found, limiting release transparency, though this is a transparency gap rather than a standalone health failure.
The package has a long history and 58 releases, but it has had no releases in the last 12 months, which weakens evidence of ongoing maintenance.
The repository recorded zero commits and zero active maintainers in the last three months, indicating paused recent development and some abandonment risk.
There were no new or closed issues or pull requests in the last month, which is consistent with the lack of recent commits and provides little evidence of active upkeep.
The repository uses a build tool, but no security-scanning tooling was detected; this is a modest hygiene gap rather than evidence the package is unfit.
| Title | Versions | Severity |
|---|---|---|
CVE-2024-21538 cross-spawn is vulnerable to Inefficient Regular Expression Complexity in versions 7.0.0 - 7.0.5 and 0.0.0 - 6.0.6. | 0.0.0 - 6.0.67.0.0 - 7.0.5 | High |
| Dependency | Last Release | Score |
|---|---|---|
which Version ^2.0.1 | — | — |
path-key Version ^3.1.0 | — | — |
shebang-command Version ^2.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.