zx

A tool for writing better scripts

Latest 8.8.5

NPM

88%

Total Score

Maintainer Stability

100

Maturity

100

Supply Chain

Attestations

100

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 8 workflows were analyzed successfully and all use read-only permissions, with no untrusted checkout or script-injection paths. However, 66 of 78 action references are unpinned, and high-confidence audits found ad hoc package installs in documentation and test workflows; the low-confidence cache findings are hygiene concerns only.

Vulnerabilities

Title	Versions	Severity
CVE-2025-13437 zx is vulnerable to Use of Incorrectly-Resolved Name or Reference in versions 0.0.0 - 8.8.5.	0.0.0 - 8.8.5	Medium
AIKIDO-2025-10655 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. zx is vulnerable to OS Command Injection in versions 8.5.0 - 8.8.1.	8.5.0 - 8.8.1	Medium
CVE-2025-24959 zx is vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in versions 8.3.1 - 8.3.1.	8.3.1 - 8.3.1	Medium