unhead
Full-stack manager built for any framework.
86%
Total Score
healthy
Active releases and seven recent contributors support this release, but workflow template injection and broad write permissions keep it below top health.
Health Score Breakdown
The project uses established build and test tooling, including TypeScript and Vitest. No security-scanning tool was detected, which is a modest transparency gap but is partly offset by the repository security policy and workflow audit.
All four workflows were analyzed and all 24 action references are pinned, but one high-confidence template-injection finding and three workflows with top-level write permissions warrant caution. Low-confidence cache-poisoning and low-severity adhoc-package findings are hygiene concerns rather than standalone severe risks.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-463850 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. unhead is vulnerable to Cross-Site Scripting (XSS) in versions 3.0.0 - 3.1.6. | 3.0.0 - 3.1.6 | Medium |
CVE-2026-39315 unhead is vulnerable to Incomplete List of Disallowed Inputs in versions 0.0.0 - 2.1.13. | 0.0.0 - 2.1.13 | Medium |
AIKIDO-2026-10361 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. unhead is vulnerable to Prototype Pollution in versions 0.0.1 - 2.1.11. | 0.0.1 - 2.1.11 | Medium |
AIKIDO-2026-10348 unhead is vulnerable to Cross-Site Scripting in versions 0.0.1 - 2.1.10. | 0.0.1 - 2.1.10 | High |
CVE-2026-31873 unhead is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.1.10. | 0.0.0 - 2.1.10 | Low |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 hookable Version ^6.1.1 | — | — |
unplugin Version ^3.3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 day ago
- Created
- 3 years ago
- Unpacked Size
- 0.7 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.