Type checking for JavaScript functions
68%
Total Score
50
100
83
67
50
No build attestation, trusted publisher, or staged publishing evidence is present, leaving publication provenance less transparent.
Only one registry publishing account is listed. This is a concentration risk for release continuity, although registry access records do not establish actual project activity on their own.
The repository is owned by an individual rather than an organization, so the single-maintainer continuity concern is not offset by visible organization backing.
The project is established, with 38 releases over roughly 12 years and one release in the last 12 months. The long median interval and sparse recent cadence suggest slower maintenance, but not abandonment by themselves.
The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign that maintenance has currently slowed.
| Title | Versions | Severity |
|---|---|---|
CVE-2017-1001004 typed-function is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.0.0 - 0.10.6. | 0.0.0 - 0.10.6 | High |
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.