Get image size without full download (JPG, GIF, PNG, WebP, BMP, TIFF, PSD)
82%
Total Score
83
100
88
88
All 10 recent commits came from one contributor, creating a meaningful continuity risk. Organization backing partly compensates because maintenance can potentially be handed off.
No build tools or security-scanning tools were detected. This is a modest process gap, although the package has active commits, tests in the repository, and a clean workflow audit.
No type declarations are published. This is a minor integration gap for consumers using TypeScript, but it does not by itself indicate abandonment or unsafe maintenance.
All workflows were analyzed with no audit findings, no untrusted checkouts, and read-only permissions. However, all three action references are unpinned, leaving a modest reproducibility and action-update risk.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-86953 probe-image-size is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 2.0.0 - 7.3.0. | 2.0.0 - 7.3.0 | High |
| Dependency | Last Release | Score |
|---|---|---|
needle Version ^2.5.2 | — | — |
lodash.merge Version ^4.6.2 | — | — |
stream-parser Version ~0.3.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.