Package Health/microsoft/microsoft-graph-core

microsoft/microsoft-graph-core

The project has clear licensing, release notes, repository tests, and security tooling. Recent repository activity is absent, and its workflows include a high-confidence broad GitHub App permission issue plus 9 of 10 unpinned actions.

Latest v3.0.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

100

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

The repository had zero commits and zero active maintainers in the three months before collection, a meaningful maintenance warning for a library dependency.

Repo issue activity

There were no newly closed issues and no merged pull requests in the last month, although one pull request was opened; this supports the concern about limited recent maintenance.

Workflow audit

All four workflows were analyzed with no untrusted checkout or script-injection findings, but 9 of 10 action references are unpinned. A high-confidence finding reports a GitHub App token inheriting blanket installation permissions, and a medium-confidence finding uses an archived action; together these are genuine workflow hygiene and permission risks.

Vulnerabilities

Title	Versions	Severity
CVE-2023-49283 microsoft/microsoft-graph-core is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 2.0.2.	0.0.0 - 2.0.2	Medium

Package versions

Maintainers

Microsoft Graph Client Tooling

Direct Dependencies

Dependency	Last Release	Score
microsoft/kiota-http-guzzle Version ^2.0.2	—	—
microsoft/kiota-serialization-form Version ^2.0.2	—	—
microsoft/kiota-serialization-json Version ^2.0.2	—	—
microsoft/kiota-serialization-text Version ^2.0.2	—	—
microsoft/kiota-serialization-multipart Version ^2.0.2	—	—