npm package report
Is auto-changelog safe?
Checked against the XYZ decision brain: known-malicious corpus, advisories, commit-level findings, dependencies and provenance.
npm packagelast checked 2026-09-19
auto-changelog · verdict ALLOW · no known risk
0.6/10
XYZ SCORE
All signals clearclearOK
No known-malicious match, advisory, commit-level finding or anomaly.
array.prototype.find@^1.0.0clean
@babel/cli@^7.1.5clean
babel-cli@^6.3.17clean
@babel/core@^7.14.3clean
babel-core@^6.3.26clean
babel-eslint@^10.0.1clean
@babel/node@^7.0.0clean
babel-plugin-istanbul@^4.1.5clean
babel-plugin-rewire@^1.1.0clean
@babel/polyfill@^7.0.0clean
babel-polyfill@^6.26.0clean
@babel/preset-env@^7.1.6clean
PACKAGE auto-changelogECOSYSTEM npmDECISION ALLOW
Package facts
Weekly downloads
530.6k
GitHub stars
1.4k
Centrality tier
tier 2
Build provenance
unknown
Direct dependencies
12
History on this package: OpenSSF Scorecard overall=2.6 (2-5 — weak hygiene)
Baked snapshot · run a live check for the current verdict · browse all packages
Other package reports
auto-it__releasedautobind-decoratorautocannonauto-bindautoauth__drizzle-adapter