strapi-plugin-comments
Strapi - Comments plugin
84%
Total Score
100
94
67
50
Health Score Breakdown
The release has no build attestation or trusted-publisher provenance, leaving the connection between published artifact and source less independently verifiable.
A prepare script runs during installation or packaging, adding some execution surface, but this signal provides no evidence that it performs unsafe work.
The project uses npm scripts and TypeScript, but no security-scanning tools were detected, leaving a modest repository hygiene gap.
No repository security policy was found, reducing transparency about vulnerability reporting and maintainer response procedures.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10171 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. strapi-plugin-comments is vulnerable to Cross-site Scripting (XSS) in versions 1.0.0 - 3.2.0. | 1.0.0 - 3.2.0 | High |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 zod Version ^3.23.8 | — | — |
zustand Version ^5.0.0-rc.2 | — | — |
codemirror5 Version npm:codemirror@^5.65.11 | — | — |
match-sorter Version ^6.3.4 | — | — |
no-profanity Version ^1.5.1 | — | — |
Weekly Downloads
Info
- Last Published
- 6 months ago
- Created
- 6 years ago
- Unpacked Size
- 8 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.