drizzle-orm

Drizzle ORM package for SQL databases

Latest 0.45.4

NPM

84%

Total Score

healthy

Frequent releases, organization backing, and verified npm provenance outweigh workflow hygiene gaps.

Are you affected? Scan for Free

Health Score Breakdown

Version stability

Version 0.45.4 is not a prerelease, but 90% of recent releases are prereleases and the package remains below 1.0, so consumers should expect ongoing API evolution.

Workflow audit

All five workflows were analyzed with no failed files, untrusted checkouts, script injections, or dangerous triggers. However, all 32 action references are unpinned, workflows use floating latest container images, and high-confidence template-injection findings plus ad hoc package installs create workflow hygiene concerns.

Vulnerabilities

Title	Versions	Severity
CVE-2026-39356 drizzle-orm is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 0.0.0 - 0.45.2 and 1.0.0-beta.2 - 1.0.0-beta.20.	0.0.0 - 0.45.21.0.0-beta.2 - 1.0.0-beta.20	High