isomorphic-git

A pure JavaScript reimplementation of git for node and browsers

Latest 1.44.2

82%

Total Score

healthy

Active project with strong maintenance signals, but every workflow action is unpinned and its CI has a template-injection finding.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent; active repository and release signals partly compensate but do not remove the gap.

Repo tooling

The repository uses TypeScript, Webpack, Rollup, and npm scripts for builds, but no security scanning tools were detected, leaving a modest security-process gap.

Security policy

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Workflow audit

Both workflows were analyzed successfully with no untrusted checkouts, script injections, or broad top-level writes. However, all 14 action references are unpinned, and the medium-confidence template-injection finding in CI warrants workflow review.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-568462 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. isomorphic-git is vulnerable to Path Traversal in versions 1.37.0 - 1.38.7.	1.37.0 - 1.38.7	High
AIKIDO-2026-271210 isomorphic-git is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.38.5.	0.0.1 - 1.38.5	Medium
AIKIDO-2026-598108 isomorphic-git is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.38.5.	0.0.1 - 1.38.5	Medium
AIKIDO-2026-140062 isomorphic-git is vulnerable to Path Traversal in versions 0.0.1 - 1.38.6.	0.0.1 - 1.38.6	High
AIKIDO-2026-224928 isomorphic-git is vulnerable to Path Traversal in versions 0.0.1 - 1.38.5.	0.0.1 - 1.38.5	Medium