seroval

seroval 1.6.7 appears to be a healthy dependency: it has a long release history with 87 releases, 18 releases in the last 12 months, a stable non-prerelease version, active recent repository work, six active contributors, and no deprecation or archival indicators. The package is MIT licensed, typed, dependency-free at runtime, and backed by a matching repository with tests, changelog material, security policy, automated security scanning, and restrictive workflow permissions. The main reservations are the absence of build provenance attestation and concentration of recent commits in one contributor, although the other five active contributors and ongoing release activity reduce the abandonment concern.

Latest 1.6.7

NPM

92%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

100

Attestations

Are you affected? Scan for Free

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-476182 seroval is vulnerable to Deserialization of Untrusted Data in versions 0.13.0 - 1.5.2.	0.13.0 - 1.5.2	Critical
CVE-2026-24006 seroval is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.0.0 - 1.4.0.	0.0.0 - 1.4.0	High
CVE-2026-23957 seroval is vulnerable to Allocation of Resources Without Limits or Throttling in versions 0.0.0 - 1.4.0.	0.0.0 - 1.4.0	High
CVE-2026-23956 seroval is vulnerable to Inefficient Regular Expression Complexity in versions 0.2.0 - 1.4.0.	0.2.0 - 1.4.0	High
CVE-2026-23737 seroval is vulnerable to Deserialization of Untrusted Data in versions 0.0.0 - 1.4.1.	0.0.0 - 1.4.1	High