82%
Total Score
88
89
83
One contributor made about 96% of the last three months’ commits, leaving maintenance heavily concentrated despite two additional active contributors and organization backing.
The repository name does not match this package and its README does not mention it, so the package-to-repository link is less transparent; the mismatch may reflect a monorepo subpackage but is still worth caution.
The project uses established build tools, but no security-scanning tools were detected, leaving a modest security-process gap.
All 11 workflows were analyzed, all 48 action references are pinned, and no untrusted checkout or script injection was found. The audit nevertheless identified high-confidence use of long-lived registry credentials, which is a release-hygiene concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
co Version ^4.6.0 | — | — |
chalk Version ^4.1.2 | — | — |
p-limit Version ^3.1.0 | — | — |
jest-each Version 30.5.2 | — | — |
jest-util Version 30.5.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.