streamdown
A drop-in replacement for react-markdown, designed for AI-powered streaming.
92%
Total Score
healthy
Healthy — frequent releases and active organization-backed development outweigh workflow pinning gaps.
Health Score Breakdown
All four workflows were analyzed successfully, with no untrusted checkout or script-injection findings. However, all 11 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence audit found an ad hoc package installation in the release workflow; these are workflow hygiene cautions, not evidence the release is unfit.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10843 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. streamdown is vulnerable to Inefficient Regular Expression Complexity in versions 0.0.1 - 1.5.1. | 0.0.1 - 1.5.1 | Low |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 clsx Version ^2.1.1 | — | — |
marked Version ^18.0.11 | — | — |
remend Version 1.4.0 | — | — |
unified Version ^11.0.5 | — | — |
rehype-raw Version ^7.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 11 days ago
- Created
- 1 year ago
- Unpacked Size
- 0.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.