simple-plist
A wrapper utility for interacting with plist data.
58%
Total Score
caution
Usable with caveats: no release since July 2022 and no recent commits.
Health Score Breakdown
The latest release was July 10, 2022, with no releases in the last 12 months; this is a substantial maintenance concern despite 20 releases over the package's history.
The repository recorded zero commits and zero active maintainers in the last three months, directly indicating no current development activity.
The package runs a prepare lifecycle script during installation, adding execution during dependency setup; the signal provides no evidence that the script is unsafe, so this is a limited caution.
Only one registry account has publish access. That is a thin publishing base, and combined with the lack of recent repository activity it increases continuity risk.
The repository is owned by an individual account rather than an organization, so there is no visible organizational backing to compensate for the single registry maintainer.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2022-26260 simple-plist is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in versions 0.0.0 - 1.3.1. | 0.0.0 - 1.3.1 | Critical |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 plist Version ^3.0.5 | — | — |
bplist-parser Version 0.3.1 | — | — |
bplist-creator Version 0.1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 years ago
- Created
- 13 years ago
- Unpacked Size
- 0.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.