webpack utilities used by Create React App
62%
Total Score
67
50
79
83
Twenty-four runtime dependencies create a broad dependency surface for a utility package, increasing maintenance exposure, though the signal does not show a specific problematic dependency.
The package has 116 releases over about 10 years, but it has had no release in the last 12 months and the latest release was about 19 months ago, indicating stalled maintenance.
There were zero commits and zero active maintainers in the last three months, showing that current development activity has effectively stopped.
The repository still has substantial issue and pull-request volume, but only one pull request was merged in the last month while three were opened, suggesting limited current follow-through.
The repository name does not match react-dev-utils and its README does not mention the package, which creates some uncertainty about package-to-repository alignment; the organization-owned monorepo context partly compensates.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-14802 react-dev-utils is vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') in versions 0.0.0 - 5.0.1. | 0.0.0 - 5.0.1 | High |
CVE-2021-24033 react-dev-utils is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 0.4.0 - 11.0.4. | 0.4.0 - 11.0.4 | Medium |
CVE-2018-6342 react-dev-utils is vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in versions 1.0.0 - 1.0.4, 2.0.0 - 2.0.2, 3.0.0 - 3.1.2, 4.0.0 - 4.2.2 and 5.0.0 - 5.0.2. | 1.0.0 - 1.0.42.0.0 - 2.0.23.0.0 - 3.1.2 +2 more | Critical |
| Dependency | Last Release | Score |
|---|---|---|
open Version ^8.4.0 | — | — |
chalk Version ^4.1.2 | — | — |
immer Version ^9.0.7 | — | — |
globby Version ^11.0.4 | — | — |
pkg-up Version ^3.1.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.