hypejunction/hypedropzone
The package includes a clear README, changelog, source tests, and recent repository activity. Its proprietary license and unpinned workflow actions add adoption and build-integrity concerns.
38%
Total Score
100
50
100
Health Score Breakdown
Packagist marks the entire package as abandoned, with no replacement package specified. This is a major adoption and maintenance warning despite the repository remaining available.
The latest registry release was in July 2018, with no releases in the last 12 months. Recent repository commits provide some compensation, but the published dependency itself is substantially stale.
The manifest declares a proprietary license and no license file is present in the package artifact. The repository has a license file, so the code is not entirely undocumented, but the package's stated licensing still limits suitability for open-source consumers.
Both workflows were analyzed without dangerous triggers, untrusted checkouts, or audit findings, but all 11 action references are unpinned. That leaves routine build inputs exposed to moving dependencies and is a hygiene concern.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Ismayil Khayredinov |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 npm-asset/dropzone Version <=5.4.0 || >5.5.0 | — | — |
composer/installers Version ~1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 8 years ago
- Created
- 12 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.