acquia/acquia_cms
Acquia provides clear ownership, licensing, repository tests, and a security policy. The project has had no registry release or commits for nearly two years, while its workflows use 40 unpinned actions and contain high-confidence template-injection findings.
58%
Total Score
75
94
100
Health Score Breakdown
All five workflows were analyzed, but all 40 action references are unpinned, and the release workflow has multiple high-confidence template-injection findings. Low-confidence cache-poisoning findings are hygiene concerns only, but the combination materially weakens build provenance.
The package has 50 releases over roughly five and a half years, but its latest registry release was October 29, 2024, with no releases in the last 12 months. That is a meaningful maintenance concern for a platform distribution.
The repository recorded zero commits and zero active maintainers in the last three months. This weakens evidence of current maintenance capacity, despite the separate recent-push metadata.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Michael Sherron |
| Acquia Engineering |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 drush/drush Version ^10 || ^11 || ^12 || ^13 | — | — |
drupal/shield Version ^1.7 | — | — |
nnnick/chartjs Version ^3.9 | — | — |
drupal/honeypot Version ^2.1 | — | — |
drupal/recaptcha Version ^3.1 | — | — |
Weekly Downloads
Info
- Last Published
- 1 year ago
- Created
- 5 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.