unified
parse, inspect, transform, and serialize content through syntax trees
78%
Total Score
75
100
89
75
Health Score Breakdown
One of two analyzed workflows uses pull_request_target, which warrants care in CI design, but there were no detected untrusted checkouts or script-injection patterns.
The project has 57 releases over more than 11 years, but it has had no registry releases in the last 12 months and version 11.0.5 was published about two years ago, which lowers confidence in current release activity.
The repository recorded zero commits and zero active maintainers in the last three months, a maintenance slowdown that is partly offset by the recent repository push and the project's long release history.
The repository uses TypeScript, Gulp, and npm scripts, but no security-scanning tool was detected; this is a transparency and maintenance gap rather than evidence that the package is unsafe.
Neither analyzed workflow declares top-level token permissions, leaving CI permission scope less explicit than ideal.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 bail Version ^2.0.0 | — | — |
vfile Version ^6.0.0 | — | — |
devlop Version ^1.0.0 | — | — |
extend Version ^3.0.0 | — | — |
trough Version ^2.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 years ago
- Created
- 11 years ago
- Unpacked Size
- 0.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.