julianshapiro/velocity
Accelerated JavaScript animation.
- Repository: https://github.com/julianshapiro/velocity
- Commit:
767e35cac12120be526eef330e4d988b2c3cfc3c - Generated: 2026-11-13T23:21:25+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | none-detected | 65% | 100% |
| Code quality | 40 | poor | 90% | 100% |
| Security | 52 | weak | 85% | 100% |
AI provenance
No AI attribution or AI-consistent velocity signals detected.
- Explicitly attributed share (lower bound): 0.0%
- Unattributed share in AI-consistent velocity bursts: 0.0%
- Estimated AI-generated share: 0.0%
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2017-10 | 9,286 | 0% |
| 2017-11 | 14,110 | 0% |
| 2017-12 | 1,962 | 0% |
| 2018-01 | 5,045 | 0% |
| 2018-02 | 1,604 | 0% |
| 2018-03 | 7,326 | 0% |
| 2018-05 | 22,121 | 0% |
| 2018-06 | 2,712 | 0% |
| 2018-07 | 51 | 0% |
| 2018-08 | 412 | 0% |
| 2019-11 | 1 | 0% |
| 2020-04 | 383 | 0% |
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is poor: test-to-source ratio 0.26, no CI test run detected; 53% of function code in complex or long functions; 63% duplicated lines. Weakest area: type safety.
| Area | Score |
|---|---|
| Complexity (lizard) | 21 |
| Duplication | 2 |
| Code smells (Opengrep) | 96 |
| Tests and CI | 41 |
| Documentation | 100 |
| Type safety | 0 |
| Process (Scorecard review/maintenance) | 5 |
- Functions: 717; mean complexity 4.9, 90th percentile 9; 42 complex and 21 long functions
- Duplicated lines: 62.7% of 13,930 compared
- Tests: 5,449 test lines for 20,801 source lines (ratio 0.26); CI test commands: none detected; 21% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- Velocity$1 in velocity.es5.js: complexity 96, 253 lines
- Velocity$1 in velocity.js: complexity 96, 253 lines
- Velocity in src/velocityFn.ts: complexity 88, 254 lines
- tick in src/Velocity/tick.ts: complexity 67, 166 lines
- tick in velocity.es5.js: complexity 67, 166 lines
Security
Security posture is weak: 123 known vulnerabilities in 40 dependencies; 10 high-severity SAST findings. Weakest area: posture.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 83 |
| Vulnerable dependencies (OSV) | 0 |
| CI workflows (zizmor) | n/a |
| Posture (policy, updates, signing, lockfiles) | 0 |
| OpenSSF Scorecard | 25 |
-
Known vulnerabilities: 123 in 40 packages (critical 19, high 61, medium 30, low 5)
-
Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits
-
OpenSSF Scorecard aggregate: 2.1/10 (published 2026-11-09)
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-67hx-6x53-jw92: babel-traverse@6.26.0 (npm) is affected by GHSA-67hx-6x53-jw92 |
package-lock.json |
| critical | osv/GHSA-fjxv-7rqg-78g4: form-data@2.3.2 (npm) is affected by GHSA-fjxv-7rqg-78g4 |
package-lock.json |
| critical | osv/GHSA-8r6j-v8pm-fqw3: fsevents@1.2.4 (npm) is affected by GHSA-8r6j-v8pm-fqw3 |
package-lock.json |
| critical | osv/GHSA-2w6w-674q-4c4q: handlebars@4.0.11 (npm) is affected by GHSA-2w6w-674q-4c4q |
package-lock.json |
| critical | osv/GHSA-765h-qjxv-5f44: handlebars@4.0.11 (npm) is affected by GHSA-765h-qjxv-5f44 |
package-lock.json |
| critical | osv/GHSA-8r5x-fm3f-whwj: handlebars@4.0.11 (npm) is affected by GHSA-8r5x-fm3f-whwj |
package-lock.json |
| critical | osv/GHSA-f2jv-r9rf-7988: handlebars@4.0.11 (npm) is affected by GHSA-f2jv-r9rf-7988 |
package-lock.json |
| critical | osv/GHSA-p8wg-vrv2-v86f: handlebars@4.0.11 (npm) is affected by GHSA-p8wg-vrv2-v86f |
package-lock.json |
| critical | osv/GHSA-w457-6q6x-cgp9: handlebars@4.0.11 (npm) is affected by GHSA-w457-6q6x-cgp9 |
package-lock.json |
| critical | osv/GHSA-896r-f27r-55mw: json-schema@0.2.3 (npm) is affected by GHSA-896r-f27r-55mw |
package-lock.json |
| critical | osv/GHSA-jf85-cpcp-j695: lodash@4.17.10 (npm) is affected by GHSA-jf85-cpcp-j695 |
package-lock.json |
| critical | osv/GHSA-jf85-cpcp-j695: lodash@4.17.9 (npm) is affected by GHSA-jf85-cpcp-j695 |
package-lock.json |
| critical | osv/GHSA-xvch-5gv4-984h: minimist@0.0.10 (npm) is affected by GHSA-xvch-5gv4-984h |
package-lock.json |
| critical | osv/GHSA-xvch-5gv4-984h: minimist@0.0.8 (npm) is affected by GHSA-xvch-5gv4-984h |
package-lock.json |
| critical | osv/GHSA-xvch-5gv4-984h: minimist@1.2.0 (npm) is affected by GHSA-xvch-5gv4-984h |
package-lock.json |
| critical | osv/GHSA-fhjf-83wg-r2j9: mixin-deep@1.3.1 (npm) is affected by GHSA-fhjf-83wg-r2j9 |
package-lock.json |
| critical | osv/GHSA-4g88-fppr-53pp: set-value@0.4.3 (npm) is affected by GHSA-4g88-fppr-53pp |
package-lock.json |
| critical | osv/GHSA-4g88-fppr-53pp: set-value@2.0.0 (npm) is affected by GHSA-4g88-fppr-53pp |
package-lock.json |
| critical | osv/GHSA-23hp-3jrh-7fpw: tar@4.4.1 (npm) is affected by GHSA-23hp-3jrh-7fpw |
package-lock.json |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/velocity.ts:112 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a div.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
src/velocity.ts:112 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
velocity.es5.js:3965 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a div.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
velocity.es5.js:3965 |
| high | opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
velocity.es5.js:4779 |
| high | opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a div.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] |
velocity.es5.js:4779 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 20,801; test lines: 5,449
| Language | Lines |
|---|---|
| JavaScript | 13,862 |
| TypeScript | 12,388 |