squirrelly

Clear documentation, TypeScript declarations, tests, release notes, and no runtime dependencies make integration straightforward. Maintenance is thin: only one commit in three months, one active contributor, and no security policy, so pin this version and monitor it.

Latest 9.1.1

NPM

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publishing provenance is present, leaving the origin of the published artifact less transparent.

Release history

The package is mature, with 70 releases since 2017 and a release in the last 12 months, but the recent cadence is sparse at one release in that period.

Repo bus factor

One contributor made all commits in the last three months, leaving maintenance dependent on a single active contributor.

Repo commit activity

Only one commit was recorded in the last three months, indicating very light recent maintenance despite the latest release being recent.

Repo issue activity

The repository has open issues and pull requests, but no new or closed issues and no merged pull requests in the last month, consistent with limited recent activity.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-273611 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. squirrelly is vulnerable to Code Injection in versions 8.0.0 - 9.1.0.	8.0.0 - 9.1.0	High
CVE-2024-40453 squirrelly is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 9.0.0 - 9.1.0.	9.0.0 - 9.1.0	Critical
CVE-2021-32819 squirrelly is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 8.0.8.	0.0.0 - 8.0.8	High