An extremely fast JavaScript and CSS bundler and minifier.
88%
Total Score
60
50
94
70
100
There are 26 runtime dependencies, all platform-specific esbuild packages, which is a broad dependency surface but consistent with distributing native binaries for multiple platforms.
A postinstall script runs during installation, adding supply-chain and installation complexity even though the package structure indicates it is used to install the platform-specific executable.
Only one registry account has publish access, creating publishing concentration; this is partly offset by the active linked repository and its multiple recent contributors.
The repository is owned by an individual rather than an organization, so the concentrated contributor activity and single registry maintainer represent a genuine continuity concern.
One contributor made about 91% of the 34 recent commits, a substantial continuity risk despite three other contributors remaining active.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-725219 esbuild is vulnerable to Path Traversal in versions 0.17.0 - 0.28.0. | 0.17.0 - 0.28.0 | Low |
AIKIDO-2026-445064 esbuild is vulnerable to Code Injection in versions 0.17.0 - 0.28.0. | 0.17.0 - 0.28.0 | High |
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.