Default code-generator for pug. It generates HTML via a JavaScript template function.
68%
Total Score
67
100
94
90
100
There were zero commits and zero active maintainers in the last three months. Although a recent release shows some ongoing activity, the current pause is a real maintenance concern.
No issues were opened or closed in the last month, while 300 issues remain open; two pull requests were opened but none were merged. This suggests limited recent project responsiveness.
The repository uses build tooling, but no security scanning tools were detected. The missing scanning is a modest hygiene gap, not evidence that the package is unsafe to depend on by itself.
One workflow lacks top-level permissions and another grants top-level write access. This is a workflow-hardening gap, though the separate workflow analysis found no dangerous trigger or checkout patterns.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2024-10106 pug-code-gen is vulnerable to Remote Code Execution (RCE) in versions 2.0.0 - 3.0.2. | 2.0.0 - 3.0.2 | High |
| Dependency | Last Release | Score |
|---|---|---|
with Version ^7.0.0 | — | — |
doctypes Version ^1.1.0 | — | — |
pug-attrs Version ^3.0.0 | — | — |
pug-error Version ^2.1.0 | — | — |
pug-runtime Version ^3.0.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.