h3-js
Pure-Javascript version of the H3 library, a hexagon-based geographic grid system
91%
Total Score
healthy
Healthy release with active organizational backing, though workflow references are unpinned.
Health Score Breakdown
No build attestation or trusted-publisher provenance is present, so the registry artifact's connection to the source build is less independently verifiable.
No security policy is present in the repository, which limits published guidance for reporting and handling vulnerabilities.
The single workflow was fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. All 5 of 5 action references are unpinned, leaving them exposed to mutable upstream changes.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-355916 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. h3-js is vulnerable to Memory Corruption in versions 4.0.0 - 4.4.0. | 4.0.0 - 4.4.0 | Medium |
Package versions
Maintainers
Direct Dependencies
No direct dependencies.
Weekly Downloads
Info
- Last Published
- 3 months ago
- Created
- 8 years ago
- Unpacked Size
- 7.4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.