ip-address

A library for parsing IPv4 and IPv6 IP addresses in node and the browser.

Latest 10.7.4

82%

Total Score

healthy

Active, mature package with strong documentation, but all recent commits come from one contributor and release workflow hygiene is imperfect.

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factor

All 37 recent commits came from one contributor, with a 100% top-contributor share and only one active contributor, creating a meaningful continuity risk.

Repo tooling

The project uses TypeScript and npm build tooling, but no security scanning tools were detected; the repository's separate SECURITY.md partly offsets the transparency gap.

Workflow audit

Both workflows were analyzed with no untrusted checkout or script injection, all 11 action references are pinned, and permissions are scoped or read-only. The audit also found a high-severity but low-confidence cache-poisoning pattern and a high-confidence adhoc package install, so release-workflow hygiene warrants caution.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-888678 ip-address is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 10.7.0.	0.0.1 - 10.7.0	Medium
AIKIDO-2026-340318 ip-address is vulnerable to Improper Access Control in versions 3.2.1 - 10.7.0.	3.2.1 - 10.7.0	Medium
AIKIDO-2026-596268 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. ip-address is vulnerable to Server-Side Request Forgery (SSRF) in versions 10.1.1 - 10.5.1.	10.1.1 - 10.5.1	Low
AIKIDO-2026-154096 ip-address is vulnerable to Server-Side Request Forgery (SSRF) in versions 10.2.1 - 10.5.0.	10.2.1 - 10.5.0	Medium
AIKIDO-2026-604326 ip-address is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.0.1 - 10.5.0.	0.0.1 - 10.5.0	Medium