yeoman-environment
Handles the lifecyle and bootstrapping of generators in a specific environment
90%
Total Score
healthy
Frequent releases, active organizational maintenance, and verifiable builds make this a strong dependency choice.
Health Score Breakdown
All 10 workflows were analyzed successfully with no untrusted checkout or script-injection findings. Four of 31 action uses are unpinned, one workflow grants top-level write access, and high-confidence template-injection and ad-hoc-package findings indicate workflow hygiene risks, but no dangerous trigger-and-sink combination was reported.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-42089 yeoman-environment is vulnerable to Inclusion of Functionality from Untrusted Control Sphere in versions 2.9.0 - 6.0.1. | 2.9.0 - 6.0.1 | High |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 chalk Version ^6.0.0 | — | — |
debug Version ^4.4.3 | — | — |
execa Version ^10.0.1 | — | — |
slash Version ^5.1.0 | — | — |
arrify Version ^3.0.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 days ago
- Created
- 12 years ago
- Unpacked Size
- 0.2 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.