monocart-code-viewer

It has clear documentation, typings, an MIT license, no runtime dependencies, and a recent release. The single maintainer and limited security practices make a longer-term support plan worth checking.

Latest 1.2.0

NPM

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance was found. This limits publication transparency, though it is not by itself evidence that the release is unsafe to depend on.

Maintainers

Only one registry account has publish access. The repository is user-owned rather than organization-backed, so there is limited visible publishing and ownership redundancy.

Project backing

The repository is owned by an individual account, with no organization backing shown. That is consistent with the single-maintainer picture and provides limited continuity evidence.

Release history

The package is over three years old with 21 releases, but only one release appeared in the last 12 months, indicating a slower recent cadence.

Repo commit activity

The repository recorded zero commits and zero active maintainers during the last three months. Combined with only one release in the last year, this is a meaningful maintenance concern.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-10767 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. monocart-code-viewer is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 1.1.5.	0.0.1 - 1.1.5	High