TypeScript/JavaScript client for Frappe Framework REST API
76%
Total Score
63
100
94
50
50
No build attestation or trusted-publisher identity was recorded. This weakens publication transparency, but it is a process gap rather than a health verdict on its own.
The package runs a prepare script during installation or preparation. This is a mild supply-chain and installation-complexity concern, although it is not severe on its own.
All 3 recent commits came from one contributor, giving the project a concentrated recent bus factor. The organization-owned repository provides some handoff capacity, partly offsetting this concern.
The repository had 3 commits in the last 3 months, showing some recent work but a modest pace. This is a small maintenance concern rather than evidence of abandonment.
There are 9 open issues and 1 open pull request, but no issues or pull requests were opened or closed in the last month. This suggests limited current issue-handling activity, though release activity remains positive.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10461 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. frappe-js-sdk is vulnerable to Cross-Site Request Forgery (CSRF) in versions 1.2.2 - 1.9.0. | 1.2.2 - 1.9.0 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
axios Version ^1.18.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.