js-yaml

YAML 1.2 parser and serializer

Latest 5.4.3

84%

Total Score

healthy

Active releases and an organization-backed repository support js-yaml, tempered by concentrated commits and unpinned workflow actions.

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

One contributor made about 93% of the 68 recent commits. The organization-owned repository provides some handoff capacity, but the observed activity is still highly concentrated.

Repo tooling

The project uses TypeScript, npm scripts, Rollup, and Vite, but no security scanning tools were detected; the missing scanning is a modest transparency gap.

Workflow audit

All workflows were analyzed with no injection, permission, or other audit findings, and the workflow uses read-only permissions. Both action references are unpinned, which weakens build reproducibility and update control.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-641142 js-yaml is vulnerable to Denial of Service (DoS) in versions 3.0.0 - 3.15.1 and 4.0.0 - 4.3.1.	3.0.0 - 3.15.14.0.0 - 4.3.1	High
AIKIDO-2026-543038 js-yaml is vulnerable to Denial of Service (DoS) in versions 5.0.0 - 5.4.0.	5.0.0 - 5.4.0	Medium
AIKIDO-2026-633502 js-yaml is vulnerable to Denial of Service (DoS) in versions 3.0.0 - 3.15.0 and 4.0.0 - 4.3.0.	3.0.0 - 3.15.04.0.0 - 4.3.0	High
CVE-2026-73643 js-yaml is vulnerable to Inefficient Algorithmic Complexity in versions 5.0.0 - 5.2.1.	5.0.0 - 5.2.1	High
CVE-2026-59868 js-yaml is vulnerable to Uncontrolled Resource Consumption in versions 5.0.0 - 5.1.0.	5.0.0 - 5.1.0	Medium