maplibre-gl
Typed artifacts, release notes, tests, and security tooling improve day-to-day confidence. The workflow audit found one high-confidence bot-condition issue, so pin 6.12.0 and monitor CI changes.
88%
Total Score
100
100
95
75
100
Health Score Breakdown
The package declares BSD-3-Clause and includes a license file, but artifact detection also reports MIT, creating a minor licensing-coverage ambiguity.
A prepare install-time script is present, adding execution during installation; this is a supply-chain hygiene consideration even though no separate maliciousness verdict is inferred.
All five workflows were analyzed with no untrusted checkout or script-injection findings, and only 2 of 30 actions were unpinned. However, the audit found one high-confidence bot-conditions issue and three workflows with top-level write permissions.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-516712 maplibre-gl is vulnerable to Cross-Site Scripting (XSS) in versions 5.0.0 - 6.4.0. | 5.0.0 - 6.4.0 | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 pbf Version ^5.1.2 | — | — |
earcut Version ^3.2.4 | — | — |
kdbush Version ^4.1.0 | — | — |
bidi-js Version ^1.1.0 | — | — |
potpack Version ^2.1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 days ago
- Created
- 5 years ago
- Unpacked Size
- 20.3 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.