webpack

Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

Latest 5.111.1

NPM

86%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 12 workflows were analyzed successfully, all 76 action references are pinned, and no untrusted checkout or script injection was found. However, high-confidence github-app findings in dependabot and release workflows plus high-confidence secrets-inherit indicate broader-than-needed credentials; top-level write permissions add mild exposure, while the low-confidence cache finding is only hygiene.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-318059 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. webpack is vulnerable to Prototype Pollution in versions 5.0.0 - 5.107.1.	5.0.0 - 5.107.1	Low
CVE-2025-68458 webpack is vulnerable to Server-Side Request Forgery (SSRF) in versions 5.49.0 - 5.104.0.	5.49.0 - 5.104.0	Low
AIKIDO-2025-10967 webpack is vulnerable to Server-Side Request Forgery (SSRF) in versions 5.49.0 - 5.103.0.	5.49.0 - 5.103.0	Medium
AIKIDO-2025-10746 webpack is vulnerable to Improper Access Control in versions 5.0.0 - 5.75.0.	5.0.0 - 5.75.0	Medium
AIKIDO-2024-10289 webpack is vulnerable to Cross-site Scripting (XSS) in versions 5.0.0 - 5.93.0.	5.0.0 - 5.93.0	Medium