Dependency health Workspace Pro coming soon

is-arrayishnpm

Documented supply-chain history

This package has dated incident reports relevant to its trust history. Check the affected releases and the response before drawing conclusions about its current version.

Read the incident coverage →

Vulnerabilities, end of life and next steps

Check a specific version for known advisories, documented mitigations and evidence-backed earlier-version options. Maintenance health is separate from vulnerability status.

Review remediation options →

Supply-chain news and reputation

Dated reporting about this package. These events are separate from its current maintenance score.

· npm

Chalk, debug and other npm packages carried wallet-targeting code ↗

Aikido reported compromised releases across a widely used group of npm packages. The injected browser code attempted to redirect cryptocurrency transactions to attacker-controlled destinations.

Affected versions: Affected releases differ by package; see the original report.

Packages: chalk · debug · ansi-styles · supports-color · strip-ansi · ansi-regex · color-convert · color-name · wrap-ansi · slice-ansi · is-arrayish · error-ex · color-string · simple-swizzle · has-ansi · supports-hyperlinks · chalk-template · backslash

Source: Aikido Security

All supply-chain news →
What the project says about itself
  • Build provenance — the latest release carries no provenance attestation. Source: the registry.
  • Publishers on the registry — 1. Source: the registry.
  • OpenSSF Scorecard — 2 / 10 on 2026-08-24. Source: OpenSSF, via deps.dev. A third party's view of security practice, not part of the health score.

Third-party facts checked 23 days ago; registry facts on every crawl.

State history 1
WhenChange
2026-10-14 first verdict: coasting

Badge

maintenance: coasting

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/is-arrayish.svg)](https://isitdeadyet.dev/npm/is-arrayish)

Watch it

Get told when is-arrayish changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.