i18next-fs-backend

i18next-fs-backend 2.6.8 appears healthy and suitable for dependency use: it has a long release history with eight releases in the last 12 months, is stable and not deprecated, has an active unarchived repository, clear MIT licensing, type declarations, tests in the repository, and no install-time lifecycle scripts or runtime dependencies. The main concerns are that all four recent commits came from one contributor, repository security scanning is absent, workflow token permissions are not explicitly declared, and there is no build provenance attestation. These reduce supply-chain transparency and resilience but are outweighed by the package's continued release activity, organization backing, repository alignment, security policy, and recent merged pull requests.

Latest 2.6.8

NPM

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10994 i18next-fs-backend is vulnerable to Prototype Pollution in versions 0.0.1 - 2.6.5.	0.0.1 - 2.6.5	Critical
CVE-2026-41693 i18next-fs-backend is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 2.6.4.	0.0.0 - 2.6.4	High