shakapacker
Use webpack to manage app-like JavaScript modules in Rails
86%
Total Score
100
100
94
83
Health Score Breakdown
The project uses established build tooling, but no security-scanning tools were detected. The repository's SECURITY.md provides some compensating security process, though automated coverage is limited.
All 11 workflows were analyzed with no untrusted checkouts or script injection, but 43 of 44 action references are unpinned and a high-confidence finding reports blanket GitHub App permissions. These are meaningful workflow hygiene and credential-scope concerns, though no top-level write permissions were found.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10416 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. shakapacker is vulnerable to Path Traversal in versions 9.2.0 - 9.6.1. | 9.2.0 - 9.6.1 | Medium |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 yargs Version ^17.7.2 | — | — |
js-yaml Version ^4.1.0 | — | — |
webpack-merge Version ^5.8.0 | — | — |
pack-config-diff Version ^0.1.0 | — | — |
path-complete-extname Version ^1.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 4 years ago
- Unpacked Size
- 0.4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.