The React Native multithreading library
84%
Total Score
100
50
90
67
100
The package declares 16 runtime dependencies, including a substantial Babel transformation stack; this is a meaningful dependency surface but is consistent with its runtime and build functionality.
The project uses TypeScript, npm scripts, and Babel, but no security-scanning tooling was detected, leaving a modest verification gap.
No repository security policy was found, so the project does not clearly document how maintainers receive and handle vulnerability reports.
This is not a stable major release and 90% of recent releases are prereleases, which makes compatibility expectations less settled despite the strong release cadence.
All 72 analyzed action references are pinned and no untrusted checkout or script-injection sinks were found, but only 30 of 45 workflows were analyzed; a high-confidence template-injection finding and several top-level write permissions warrant caution.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-722550 New react-native-worklets is vulnerable to Prototype Pollution in versions 0.5.0 - 0.12.1. | 0.5.0 - 0.12.1 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
semver Version ^7.7.4 | — | — |
@babel/types Version ^7.27.1 | — | — |
whatwg-fetch Version ^3.6.20 | — | — |
@babel/traverse Version ^7.27.1 | — | — |
@babel/generator Version ^7.27.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.