h5wasm

The project has clear documentation, tests, release notes, and a strong release cadence. Recent work is concentrated in one contributor, and all six workflow actions are unpinned; organization backing and build provenance reduce the concern.

Latest 0.10.3

NPM

79%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

All two recent commits came from one contributor, creating concentration risk; the organization-owned repository provides some capacity to hand maintenance off.

Repo commit activity

Only two commits were made in the last three months, so recent development is modest despite the recent release history.

Repo issue activity

There was one issue closure and two merged pull requests in the last month, but no new issues or pull requests, indicating limited recent interaction rather than clear abandonment.

Security policy

No repository security policy was found, leaving vulnerability reporting expectations unclear.

Workflow audit

The sole workflow was fully analyzed and scopes permissions at job level, with no untrusted checkouts or script injection. However, all six action references are unpinned; the reported cache-poisoning findings are low-confidence hygiene warnings and do not independently establish a severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-713161 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. h5wasm is vulnerable to Heap-based Buffer Overflow in versions 0.7.6 - 0.10.2.	0.7.6 - 0.10.2	Medium