ActionRank
Check your actions

NPM Publish

Stale

JS-DevTools/npm-publish · MIT

GitHub Action to publish to NPM

★ 668 starsLast commit 4 months agoLatest v4.1.5
C
58
/ 100
Security 51Maintenance 63Popularity 52Reliability 70

Security signals

OpenSSF Scorecard3.5 / 10
SECURITY.md presentNo
Immutable releasesEnabled
Known vulnerabilitiesNone on record

How to use it safely

Recommended: pin to commit SHA
uses: JS-DevTools/npm-publish@0fd2f4369c5d6bcfcde6091a7c527d810b9b5c3f # v4.1.5

Mutable tags like v4.1.5 can be rewritten to point at malicious commits. Pinning to the full commit SHA is the only reference GitHub guarantees immutable.

Full workflow example
steps:
  - uses: JS-DevTools/npm-publish@0fd2f4369c5d6bcfcde6091a7c527d810b9b5c3f # v4.1.5

Score breakdown

Security (35%)51
Popularity (20%)52
Maintenance (30%)63
Reliability (15%)70