isomorphic-git

A pure JavaScript reimplementation of git for node and browsers

Latest 1.44.3

NPM

84%

Total Score

healthy

Frequent releases and broad contributor activity outweigh unpinned workflow actions and limited security transparency.

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

The release has no attestation or trusted-publisher provenance, leaving the published artifact's build chain less independently verifiable.

Repo tooling

The project uses TypeScript, Webpack, Rollup, and npm scripts, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policy

No repository security policy was found, reducing transparency about vulnerability reporting and response practices.

Workflow audit

Both workflows were analyzed without high-severity findings or untrusted checkout sinks, but all 14 action references are unpinned and a medium-confidence template-injection finding remains; these are workflow hygiene concerns, not a standalone severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-568462 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. isomorphic-git is vulnerable to Path Traversal in versions 1.37.0 - 1.38.7.	1.37.0 - 1.38.7	High
AIKIDO-2026-271210 isomorphic-git is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.38.5.	0.0.1 - 1.38.5	Medium
AIKIDO-2026-598108 isomorphic-git is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.38.5.	0.0.1 - 1.38.5	Medium
AIKIDO-2026-140062 isomorphic-git is vulnerable to Path Traversal in versions 0.0.1 - 1.38.6.	0.0.1 - 1.38.6	High
AIKIDO-2026-224928 isomorphic-git is vulnerable to Path Traversal in versions 0.0.1 - 1.38.5.	0.0.1 - 1.38.5	Medium