protobufjs-cli
Translates between file formats and generates static code as well as TypeScript definitions.
89%
Total Score
83
100
83
100
Health Score Breakdown
One contributor made about 76% of recent commits, which concentrates maintenance risk, but seven other contributors were active and the repository is organization-owned.
Both workflows were analyzed with no untrusted checkouts or script injection, but all 12 action references are unpinned and high-confidence adhoc-package findings indicate installs outside lockfiles; the low-confidence cache finding is only hygiene.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-54271 protobufjs-cli is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.3.1 and 2.0.0 - 2.4.2. | 0.0.0 - 1.3.12.0.0 - 2.4.2 | High |
CVE-2026-44295 protobufjs-cli is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 1.2.0 and 2.0.0 - 2.0.1. | 0.0.0 - 1.2.02.0.0 - 2.0.1 | High |
CVE-2026-42290 protobufjs-cli is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.0.0 - 1.2.0 and 2.0.0 - 2.0.1. | 0.0.0 - 1.2.02.0.0 - 2.0.1 | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 tmp Version ^0.2.7 | — | — |
glob Version ^8.1.0 | — | — |
jsdoc Version ^4.0.5 | — | — |
espree Version ^9.6.1 | — | — |
minimist Version ^1.2.8 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 4 years ago
- Unpacked Size
- 0.5 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.