loader-utils

utils for webpack loaders

Latest 3.3.1

NPM

20%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing that active maintenance has stopped.

Repository archived

The linked repository is archived, and its last push was on June 5, 2024. This is a severe abandonment risk for a dependency.

Release history

The package has a long release history and 50 releases, but it has had no release in the last 12 months; the latest release was more than two years ago.

Repo issue activity

There were no new or closed issues or pull requests in the last month, leaving outstanding repository activity unresolved and consistent with the lack of maintenance.

Workflow audit

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkouts or script-injection findings. However, all seven action references are unpinned, which is a supply-chain hygiene weakness.

Vulnerabilities

Title	Versions	Severity
CVE-2022-37603 loader-utils is vulnerable to Inefficient Regular Expression Complexity in versions 1.0.0 - 1.4.2, 2.0.0 - 2.0.4 and 3.0.0 - 3.2.1.	1.0.0 - 1.4.22.0.0 - 2.0.43.0.0 - 3.2.1	High
CVE-2022-37601 loader-utils is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 2.0.0 - 2.0.3 and 0.0.0 - 1.4.1.	0.0.0 - 1.4.12.0.0 - 2.0.3	Critical
CVE-2022-37599 loader-utils is vulnerable to Uncontrolled Resource Consumption in versions 1.0.0 - 1.4.2, 2.0.0 - 2.0.4 and 3.0.0 - 3.2.1.	1.0.0 - 1.4.22.0.0 - 2.0.43.0.0 - 3.2.1	High