webdav-server

A long project history, stable versioning, typed sources, and repository tests support continued use. The lack of a security policy and security scanning leaves less evidence for maintaining a server dependency.

Latest 2.6.3

NPM

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Attestations

Are you affected? Scan for Free

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher identity is present, reducing publication transparency, but this is not by itself evidence of an unhealthy release.

Lifecycle scripts

A prepare lifecycle script runs during installation or publishing, adding build behavior that consumers should account for, though this alone is not a severe concern.

Maintainers

Only one registry account has publish access, which is a concentration concern, although the linked repository is owned by an organization that can provide backing.

Release history

The package has existed for about 9 years with 105 releases and a release within the last 2 months, but only one release appeared in the last 12 months, indicating limited recent release cadence.

Repo bus factor

All 19 commits in the last 3 months came from one contributor, creating a meaningful continuity risk; organization ownership provides only partial compensation.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-912749 webdav-server is vulnerable to Improper Access Control in versions 2.0.0 - 2.6.2.	2.0.0 - 2.6.2	High
AIKIDO-2026-593413 webdav-server is vulnerable to Path Traversal in versions 2.0.0 - 2.6.2.	2.0.0 - 2.6.2	Critical