fumadocs-openapi

The package includes bundled typings, a license, release notes, and a repository with tests and a changelog. GitHub workflows use all nine actions without pinned references, and the linked repository neither matches the package name nor mentions it in its README.

Latest 12.0.2

NPM

78%

Total Score

Maintainer Stability

Dependencies

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package declares 17 runtime dependencies and 14 development dependencies. This is a substantial dependency surface, but the signal provides no indication of abnormal or unmanaged dependencies.

Project backing

The repository is owned by the user account fuma-nama rather than an organization, so the single registry maintainer does not benefit from visible organization backing.

Repo package mention

The repository name does not match fumadocs-openapi and its README does not mention the package, so the linkage is less transparent and the package's source ownership is harder to verify.

Repo tooling

The repository uses TypeScript, Vitest, Turbo, Vite, and npm scripts, showing established build and test tooling. No security scanning tools were detected, which leaves a modest hygiene gap.

Security policy

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-389326 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. fumadocs-openapi is vulnerable to Server-Side Request Forgery (SSRF) in versions 5.10.0 - 11.2.1.	5.10.0 - 11.2.1	High