bravedave/dvc
The project has a long release history, frequent recent releases, tests, a changelog, and a matching repository. Its small audience and absent security policy leave less independent oversight.
68%
Total Score
50
92
50
Health Score Breakdown
A post-update-cmd lifecycle script runs package code after dependency updates, adding execution-time supply-chain exposure beyond ordinary metadata.
All 28 commits in the last 3 months came from one contributor, giving the project a single-person maintenance bottleneck despite the recent activity.
The repository has 1 star, 0 forks, and 1 watcher, providing little evidence of independent user scrutiny or a broader support community.
The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented.
The only workflow was fully analyzed and has no untrusted checkout, injection sink, or unpinned action use; its high-confidence template-injection finding is still a workflow hygiene concern.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 David Bray |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 nyholm/psr7 Version ^1.8 | — | — |
symfony/mailer Version ^7.1 | — | — |
league/commonmark Version ^2.4 | — | — |
nyholm/psr7-server Version ^1.1 | — | — |
matthiasmullie/minify Version ^1.3.61 | — | — |
Weekly Downloads
Info
- Last Published
- 6 days ago
- Created
- 7 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.