october/rain
The package includes tests and a readable README, with organizational ownership and a published security policy. Workflow references are unpinned, but the audit found no dangerous triggers, token exposure, or other findings.
86%
Total Score
100
94
83
Health Score Breakdown
Composer is used as the build tool, but no security scanning tools were detected. This is a modest repository hygiene gap, not evidence of abandonment or unsafe behavior by itself.
The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, which weakens build reproducibility and warrants a minor caution.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-25133 october/rain is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 4.0.0 - 4.1.9 and 0.0.0 - 3.7.13. | 0.0.0 - 3.7.134.0.0 - 4.1.9 | Medium |
CVE-2026-25125 october/rain is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 4.0.0 - 4.1.9 and 0.0.0 - 3.7.13. | 0.0.0 - 3.7.134.0.0 - 4.1.9 | Medium |
CVE-2026-22692 october/rain is vulnerable to Improper Access Control in versions 4.0.0 - 4.1.4 and 0.0.0 - 3.7.12. | 0.0.0 - 3.7.124.0.0 - 4.1.4 | Medium |
CVE-2017-15284 october/rain is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.0.426. | 0.0.0 - 1.0.426 | Medium |
CVE-2021-3311 october/rain is vulnerable to Insufficient Session Expiration in versions 0.0.0 - 1.0.472 and 1.1.0 - 1.1.2. | 0.0.0 - 1.0.4721.1.0 - 1.1.2 | Critical |
Package versions
Maintainers
 Alexey Bobkov |
| Samuel Georges |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 twig/twig Version ^3.26 | — | — |
league/csv Version ~9.1 | — | — |
symfony/yaml Version ^6.4|^7.0 | — | — |
doctrine/dbal Version ^2.13.3|^3.1.4 | — | — |
laravel/tinker Version ~2.0|~3.0 | — | — |
Weekly Downloads
Info
- Last Published
- 9 days ago
- Created
- 10 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.