grunt
The JavaScript Task Runner
78%
Total Score
90
100
95
83
50
Health Score Breakdown
The release has no build attestation or trusted-publisher provenance, leaving publication origin less independently verifiable.
There were no new or closed issues or pull requests in the last month despite 143 open issues, indicating limited recent issue-management activity.
The repository uses a build tool but reports no security-scanning tools, leaving a modest security-process gap.
The single workflow was fully analyzed with no dangerous findings, but both action references are unpinned, weakening build reproducibility and action supply-chain hygiene.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2022-1537 grunt is vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in versions 0.0.0 - 1.5.3. | 0.0.0 - 1.5.3 | High |
CVE-2022-0436 grunt is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.5.2. | 0.0.0 - 1.5.2 | Medium |
CVE-2020-7729 grunt is vulnerable to Insecure Default Initialization of Resource in versions 0.0.0 - 1.3.0. | 0.0.0 - 1.3.0 | High |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 exit Version ~0.1.2 | — | — |
glob Version ~7.1.6 | — | — |
nopt Version ^5.0.0 | — | — |
js-yaml Version ^3.15.0 | — | — |
grunt-cli Version ^1.4.3 | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 14 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.