protobufjs-cli

Translates between file formats and generates static code as well as TypeScript definitions.

Latest 2.7.1

NPM

84%

Total Score

healthy

Frequent releases and an active organization-backed repository outweigh workflow pinning and installation-hygiene gaps.

Are you affected? Scan for Free

Health Score Breakdown

Repo tooling

The repository uses TypeScript, npm scripts, and Gulp, but no security scanning tools were detected; this is a modest transparency gap rather than evidence of abandonment.

Workflow audit

Both workflows were analyzed with no untrusted checkouts or script injection, but all 12 action references are unpinned and two workflows install packages outside a lockfile. The low-confidence cache-poisoning finding is hygiene-level only.

Vulnerabilities

Title	Versions	Severity
CVE-2026-54271 protobufjs-cli is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.3.1 and 2.0.0 - 2.4.2.	0.0.0 - 1.3.12.0.0 - 2.4.2	High
CVE-2026-44295 protobufjs-cli is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.2.0 and 2.0.0 - 2.0.1.	0.0.0 - 1.2.02.0.0 - 2.0.1	High
CVE-2026-42290 protobufjs-cli is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 1.2.0 and 2.0.0 - 2.0.1.	0.0.0 - 1.2.02.0.0 - 2.0.1	High