log4js
Port of Log4js to work with node.
68%
Total Score
100
100
95
75
Health Score Breakdown
The package defines a prepare lifecycle script. This adds install-time behavior, but the signal does not show that it is unsafe or unusually complex.
The package has 152 releases, but none in the last 12 months and its latest registry release was in March 2023. This long release gap lowers confidence in depending on this specific release despite the project's long history.
All four workflows were analyzed with no untrusted checkout or script-injection sink, but all 12 action references are unpinned and the publishing workflow has a high-confidence template-injection finding plus trusted-publishing usage. These are workflow hygiene and supply-chain concerns, though no dangerous trigger is present.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2022-21704 log4js is vulnerable to Incorrect Default Permissions in versions 0.0.0 - 6.4.0. | 0.0.0 - 6.4.0 | Medium |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 rfdc Version ^1.3.0 | — | — |
debug Version ^4.3.4 | — | — |
flatted Version ^3.2.7 | — | — |
date-format Version ^4.0.14 | — | — |
streamroller Version ^3.1.5 | — | — |
Weekly Downloads
Info
- Last Published
- 3 years ago
- Created
- 15 years ago
- Unpacked Size
- 0.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.