its-fine
It has clear licensing, TypeScript declarations, repository tests, and a substantial README. Unpinned workflow dependencies, an ad hoc package install, absent build attestation, and no security policy reduce transparency.
72%
Total Score
88
100
94
75
50
Health Score Breakdown
No build attestation, trusted publisher, or staged publishing is reported, leaving the connection between the source and published artifact less transparent.
No commits or active maintainers were recorded in the last three months, which is a maintenance concern, although the recent release and merged pull requests partly compensate for it.
The repository uses TypeScript, Vite, and npm scripts, but no security scanning tools are configured, leaving a modest tooling gap.
The repository has no security policy, so vulnerability reporting and response expectations are not documented.
The single workflow was fully analyzed with no dangerous triggers or script-injection findings, but both action references are unpinned and it installs a package outside the lockfile. The high-confidence adhoc-packages finding and incomplete pinning weaken workflow reproducibility.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 @types/react-reconciler Version ^0.28.9 | — | — |
Weekly Downloads
Info
- Last Published
- 10 days ago
- Created
- 4 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.