turbo

Turborepo is the build system for coding agents.

Latest 2.11.9

NPM

86%

Total Score

healthy

Active releases and broad repository activity outweigh concentrated commits and a few workflow-audit concerns.

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

One contributor made about 85% of the last three months' commits, which creates concentration risk. The organization-owned repository and 26 active maintainers partly compensate, but the concentration remains a caution.

Workflow audit

All 12 workflows were analyzed with no untrusted checkouts or script injections, and 11 use read-only permissions. High-confidence template injection, inherited secrets, ad hoc package installs, and trusted-publishing findings still warrant workflow hygiene caution.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-427079 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. turbo is vulnerable to Path Traversal in versions 1.0.0 - 2.9.17.	1.0.0 - 2.9.17	Low
AIKIDO-2026-10952 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. turbo is vulnerable to Race Condition (TOCTOU) in versions 0.0.1 - 2.9.14.	0.0.1 - 2.9.14	Medium
CVE-2026-45773 turbo is vulnerable to Cross-Site Request Forgery (CSRF) in versions 0.0.0 - 2.9.13.	0.0.0 - 2.9.13	Medium
CVE-2026-45772 turbo is vulnerable to Untrusted Search Path in versions 1.1.0 - 2.9.14.	1.1.0 - 2.9.14	Critical