Package Health

pug-code-gen

Default code-generator for pug. It generates HTML via a JavaScript template function.

Latest 3.0.4NPMNPM

68%

Total Score

Maintainer Stability
Maintainer Stability
Assesses the consistency and reliability of package maintainers

67

Dependencies
Dependencies
Evaluates the health and security of package dependencies

100

Maturity
Maturity
Indicates package age, release frequency, and adoption metrics

94

Supply Chain
Supply Chain
Evaluates supply chain security practices and risks

90

Attestations
Attestations
Measures the presence and validity of package attestations and signatures

100

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although a recent release shows some ongoing activity, the current pause is a real maintenance concern.

Repo issue activitycaution

No issues were opened or closed in the last month, while 300 issues remain open; two pull requests were opened but none were merged. This suggests limited recent project responsiveness.

Repo toolingcaution

The repository uses build tooling, but no security scanning tools were detected. The missing scanning is a modest hygiene gap, not evidence that the package is unsafe to depend on by itself.

Token permissionscaution

One workflow lacks top-level permissions and another grants top-level write access. This is a workflow-hardening gap, though the separate workflow analysis found no dangerous trigger or checkout patterns.

Vulnerabilities

TitleVersionsSeverity
AIKIDO-2024-10106
pug-code-gen is vulnerable to Remote Code Execution (RCE) in versions 2.0.0 - 3.0.2.
2.0.0 - 3.0.2
High

Package versions

Direct Dependencies

DependencyLast ReleaseScore
with
Version ^7.0.0
—
—
doctypes
Version ^1.1.0
—
—
pug-attrs
Version ^3.0.0
—
—
pug-error
Version ^2.1.0
—
—
pug-runtime
Version ^3.0.1
—
—

Weekly Downloads

Info

Last Published
7 months ago
Created
10 years ago
Unpacked Size
0.1 MB

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform