mppx

Latest 0.13.4

88%

Total Score

healthy

Active releases, broad contributor activity, and an audited repository support this release; workflow publishing hygiene is the main concern.

Are you affected? Scan for Free

Health Score Breakdown

Version stability

Version 0.13.4 is not a prerelease, but the package is still below 1.0 and 80% of recent versions are prereleases, so its API may continue to change.

Workflow audit

All 13 workflows were analyzed with no failed files, no untrusted checkout or script-injection counts, and only two of 30 action uses unpinned. The audit still flags high-confidence template injection and trusted-publishing hygiene; the latter warrants caution, while the template finding is not corroborated by an unsafe trigger and remains hygiene.

Vulnerabilities

Title	Versions	Severity
CVE-2026-63628 mppx is vulnerable to Improper Input Validation in versions 0.0.0 - 0.8.2.	0.0.0 - 0.8.2	Low
CVE-2026-63627 mppx is vulnerable to Improper Input Validation in versions 0.0.0 - 0.8.1.	0.0.0 - 0.8.1	Medium
AIKIDO-2026-967133 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. mppx is vulnerable to Improper Neutralization of CRLF Sequences (CRLF Injection) in versions 0.1.0 - 0.6.9.	0.1.0 - 0.6.9	Medium
AIKIDO-2026-369362 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. mppx is vulnerable to Improper Authorization in versions 0.1.0 - 0.6.8.	0.1.0 - 0.6.8	Medium
AIKIDO-2026-484607 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. mppx is vulnerable to Authentication Bypass in versions 0.5.5 - 0.6.11.	0.5.5 - 0.6.11	Medium

Package versions

Maintainers

awkweb

jmoxey

brendan_j_ryan

Direct Dependencies

Dependency	Last Release	Score
ox Version 0.14.45	—	—
zod Version ^4.6.5	—	—
@stripe/stripe-js Version 9.17.0	—	—
eventsource-parser Version 4.1.1	—	—
structured-headers Version 2.1.0	—	—