Figure out what a cmd-shim is pointing at. This acts as the equivalent of fs.readlink.
72%
Total Score
caution
Usable with caveats: all 38 workflow actions are unpinned, and release workflows carry high-confidence audit findings.
The repository recorded zero commits and zero active maintainers in the last 3 months, a maintenance concern. The same period still includes a current release and two merged pull requests, partly compensating for the quiet commit count.
All 38 action references are unpinned, and four workflows grant top-level write permissions. The audit also reports high-confidence template-injection findings in pull-request and release workflows; no untrusted checkout or script-injection sink was reported, so these are important hygiene concerns rather than standalone severe risk.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.