Package Health

trix

A rich text editor for everyday writing

Latest 2.1.19NPMNPM

86%

Total Score

Maintainer Stability
Maintainer Stability
Assesses the consistency and reliability of package maintainers

88

Dependencies
Dependencies
Evaluates the health and security of package dependencies

100

Maturity
Maturity
Indicates package age, release frequency, and adoption metrics

94

Supply Chain
Supply Chain
Evaluates supply chain security practices and risks

83

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factorcaution

One contributor made 7 of 8 recent commits, creating concentration risk, but a second contributor remains active and the repository belongs to an organization that can hand maintenance off.

Type declarationscaution

No type declarations are included, which makes integration less convenient for TypeScript consumers, but this is a consumer-ergonomics gap rather than an abandonment signal.

Workflow auditcaution

All workflows were analyzed, use read-only permissions, and pin all 12 action references. The audit found two high-confidence low-severity adhoc package installations, a limited workflow hygiene concern rather than a severe risk.

Vulnerabilities

TitleVersionsSeverity
CVE-2026-73428
trix is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.1.18.
0.0.0 - 2.1.18
Medium
CVE-2026-73427
trix is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.1.18.
0.0.0 - 2.1.18
Low
AIKIDO-2025-10299
trix is vulnerable to Cross-site Scripting (XSS) in versions 0.9.0 - 2.1.14.
0.9.0 - 2.1.14
Medium
CVE-2025-21610
trix is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.1.12.
0.0.0 - 2.1.12
Medium
CVE-2024-53847
trix is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 2.0.0 - 2.1.9 and 1.0.0 - 1.3.3.
1.0.0 - 1.3.32.0.0 - 2.1.9
Medium

Package versions

Direct Dependencies

DependencyLast ReleaseScore
dompurify
Version ^3.2.5
—
—

Weekly Downloads

Info

Last Published
5 months ago
Created
10 years ago
Unpacked Size
5.7 MB

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform