Predictable state container for JavaScript apps
92%
Total Score
100
100
94
75
100
The package has a long history with 85 releases, but no registry release occurred in the last 12 months. Active repository work partly compensates for the stale registry cadence.
No repository security policy was found, leaving vulnerability-reporting expectations less clear than they could be.
All four workflows were analyzed successfully, use actions with no unpinned references, and have no untrusted checkout or script-injection findings. High-confidence adhoc package installs and a trusted-publishing finding are workflow hygiene concerns, while top-level write permissions in two workflows add mild exposure.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.