mysql2

It is well documented, typed, licensed, and published with provenance. Workflow secret handling and fully unpinned action references are hygiene concerns, while ongoing contributor activity limits abandonment risk.

Latest 3.24.5

NPM

88%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the single registry maintainer provides less formal handoff capacity; active repository contributors partly compensate.

Workflow audit

All 13 workflows were analyzed with no untrusted checkout or script-injection findings, but all 60 action references are unpinned and three workflows inject the entire secrets context, creating notable hygiene concerns.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-765062 mysql2 is vulnerable to Insufficiently Protected Credentials in versions 3.0.0 - 3.21.1.	3.0.0 - 3.21.1	High
AIKIDO-2026-448685 mysql2 is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 3.23.0.	0.0.1 - 3.23.0	Medium
AIKIDO-2026-10225 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. mysql2 is vulnerable to SQL Injection in versions 0.0.1 - 3.16.3.	0.0.1 - 3.16.3	High
CVE-2024-21512 mysql2 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 3.9.8.	0.0.0 - 3.9.8	High
AIKIDO-2024-10037 mysql2 is vulnerable to Remote Code Execution (RCE) in versions 2.0.0 - 3.9.6.	2.0.0 - 3.9.6	Critical

Package versions

Maintainers

sidorares

Direct Dependencies

Dependency	Last Release	Score
long Version ^5.3.2	—	—
lru.min Version ^1.1.4	—	—
iconv-lite Version ^0.7.3	—	—
sql-escaper Version ^1.5.1	—	—
aws-ssl-profiles Version ^1.1.2	—	—