solid-js
A declarative JavaScript library for building user interfaces.
92%
Total Score
healthy
Frequent releases, active maintenance, and organization backing outweigh modest workflow and provenance gaps.
Health Score Breakdown
No build attestation or trusted-publisher configuration is reported, leaving publication provenance less transparent than it could be; the active project and clean workflow audit provide partial context but not equivalent verification.
Both workflows were analyzed with no untrusted checkouts, script injection, or audit findings. However, five of eight action references are unpinned and one workflow grants top-level write permissions, creating modest supply-chain hygiene risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2025-27109 solid-js is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.9.4. | 0.0.0 - 1.9.4 | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 csstype Version ^3.1.0 | — | — |
seroval Version ~1.6.8 | — | — |
seroval-plugins Version ~1.6.8 | — | — |
Weekly Downloads
Info
- Last Published
- 5 days ago
- Created
- 8 years ago
- Unpacked Size
- 1.1 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.