evp_bytestokey
The insecure key derivation algorithm from OpenSSL
61%
Total Score
75
100
90
83
50
Health Score Breakdown
The release has no build attestation or trusted-publisher provenance, so consumers cannot verify how the registry artifact was produced. This lowers supply-chain transparency but is not severe on its own.
The latest registry release was about 9 years ago, with no releases in the last 12 months. That is a significant maintenance and abandonment concern despite the package's established age and four-release history.
The repository had no commits or active maintainers in the last 3 months. Its last push was about 1 year and 9 months ago, so the source is not showing active current maintenance.
No security policy was found in the repository, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, though it is partly offset by the repository's organization backing.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 md5.js Version ^1.3.4 | — | — |
safe-buffer Version ^5.1.1 | — | — |
Weekly Downloads
Info
- Last Published
- 9 years ago
- Created
- 11 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.