psy/psysh
Healthy and suitable to depend on. It has a long release history, recent frequent releases, active development by multiple contributors, strong repository evidence, and clear build and test practices; the main caveats are missing security-policy documentation and unspecified workflow token permissions.
92%
Total Score
100
100
100
80
Health Score Breakdown
The repository has no SECURITY.md or equivalent security policy, leaving vulnerability reporting and response expectations undocumented. The active project and other security tooling partly compensate, but this remains a transparency gap.
All nine workflows lack top-level token-permission declarations. No workflow requests top-level write access, but explicitly declaring least-privilege permissions would provide stronger CI security hygiene.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-25129 psy/psysh is vulnerable to Uncontrolled Search Path Element in versions 0.12.0 - 0.12.18 and 0.0.0 - 0.11.22. | 0.0.0 - 0.11.220.12.0 - 0.12.18 | Medium |
Package versions
Maintainers
 Justin Hileman |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 symfony/console Version ^8.0 || ^7.0 || ^6.0 || ^5.0 || ^4.0 || ^3.4 | — | — |
nikic/php-parser Version ^5.0 || ^4.0 | — | — |
symfony/var-dumper Version ^8.0 || ^7.0 || ^6.0 || ^5.0 || ^4.0 || ^3.4 | — | — |
Weekly Downloads
Info
- Last Published
- 3 months ago
- Created
- 12 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.