vanilo/shipment
The package includes repository tests, a readme, a changelog, and a source tree that matches the package. Workflow references are unpinned and no security policy is published, but the audit found no dangerous workflow behavior.
78%
Total Score
83
100
50
Health Score Breakdown
All 3 recent commits came from one contributor, creating concentration risk. Organization ownership provides some maintenance backing but does not remove the lack of a second recently active contributor.
The repository has no published security policy. This is a transparency gap for a maintained library, though it is not evidence of a security incident by itself.
All 3 analyzed action references are unpinned, which weakens build reproducibility. The repository also uses a pull_request_target trigger, but the audit found no untrusted checkout, script injection, or other findings, and no workflows grant top-level write permissions.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Attila Fulop |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 konekt/enum Version ^4.2 | — | — |
konekt/address Version ^3.9 | — | — |
konekt/concord Version ^1.16 | — | — |
vanilo/support Version ^6.0 | — | — |
vanilo/contracts Version ^6.0 | — | — |
Weekly Downloads
Info
- Last Published
- 1 day ago
- Created
- 4 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.