Installations
npm install @grpc/grpc-jsReleases
@grpc/grpc-js 1.12.2
Published on 09 Oct 2024
@grpc/grpc-js 1.12.1
Published on 08 Oct 2024
@grpc/grpc-js-xds 1.12.0
Published on 03 Oct 2024
@grpc/grpc-js 1.12.0
Published on 03 Oct 2024
@grpc/grpc-js 1.11.3
Published on 17 Sept 2024
@grpc/grpc-js 1.11.2
Published on 05 Sept 2024
Developer
Developer Guide
Module System
CommonJS
Min. Node Version
>=12.10.0
Typescript Support
Yes
Node Version
20.5.0
NPM Version
9.8.0
Statistics
4,502 Stars
4,884 Commits
651 Forks
73 Watching
51 Branches
182 Contributors
Updated on 28 Nov 2024
Languages
TypeScript (84.92%)
JavaScript (12.13%)
C++ (1.46%)
Shell (0.98%)
CMake (0.14%)
Batchfile (0.13%)
Dockerfile (0.13%)
PowerShell (0.11%)
Total Downloads
Cumulative downloads
Total Downloads
1,345,773,376
Last day
-12.4%
2,108,011
Compared to previous day
Last week
0.5%
12,552,127
Compared to previous week
Last month
8.2%
52,588,342
Compared to previous month
Last year
49.4%
505,689,692
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
2
Dev Dependencies
30
gRPC on Node.js
Implementations
For a comparison of the features available in these two libraries, see this document
Pure JavaScript Client and Server
Directory: packages/grpc-js
npm package: @grpc/grpc-js
This library implements the core functionality of gRPC purely in JavaScript, without a C++ addon. It works on the latest versions of Node.js on all platforms that Node.js runs on.
C-based Client and Server (deprecated)
Directory: packages/grpc-native-core (lives in the grpc@1.24.x branch) (see here for installation information)
npm package: grpc.
This is the deprecated implementation of gRPC using a C++ addon. It works on versions of Node.js up to 14 on most platforms that Node.js runs on.
Other Packages
gRPC Protobuf Loader
Directory: packages/proto-loader
npm package: @grpc/proto-loader
This library loads .proto files into objects that can be passed to the gRPC libraries.
gRPC Tools
Directory: packages/grpc-tools
npm package: grpc-tools
Distribution of protoc and the gRPC Node protoc plugin for ease of installation with npm.
gRPC Health Check Service
Directory: packages/grpc-health-check
npm package: grpc-health-check
Health check service for gRPC servers.
gRPC Reflection API Service
Directory: packages/grpc-reflection
npm package: @grpc/reflection
Reflection API service for gRPC servers.
Stable Version
The latest stable version of the package.
Stable Version
1.12.2
HIGH
1
7.5/10
Summary
Prototype pollution in grpc and @grpc/grpc-js
Affected Versions
< 1.1.8
Patched Versions
1.1.8
MODERATE
3
5.3/10
Summary
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Affected Versions
< 1.8.22
Patched Versions
1.8.22
5.3/10
Summary
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Affected Versions
>= 1.9.0, < 1.9.15
Patched Versions
1.9.15
5.3/10
Summary
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Affected Versions
>= 1.10.0, < 1.10.9
Patched Versions
1.10.9
Reason
30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Reason
GitHub workflow tokens follow principle of least privilege
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/grpc-tools-build.yml:12
- Info: no jobLevel write permissions found
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
0 existing vulnerabilities detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: SECURITY.md:1
Reason
Found 2/12 approved changesets -- score normalized to 1
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/grpc-tools-build.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/grpc/grpc-node/grpc-tools-build.yml/master?enable=pin
- Warn: containerImage not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:19
- Warn: containerImage not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:32: pin your Docker image by updating gcr.io/distroless/nodejs18-debian11:latest to gcr.io/distroless/nodejs18-debian11:latest@sha256:c3627dd28e9e031c6b562eb7cb77c324b9c4635a1c05eaf8e89d2eaa364fa6f0
- Warn: containerImage not pinned by hash: tools/release/native/Dockerfile:6: pin your Docker image by updating ubuntu:22.04 to ubuntu:22.04@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:26
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:28
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/interop/Dockerfile:30
- Warn: downloadThenRun not pinned by hash: tools/release/native/Dockerfile:23
- Warn: downloadThenRun not pinned by hash: packages/grpc-js-xds/scripts/xds.sh:22
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/scripts/xds.sh:38
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/scripts/xds.sh:41
- Warn: npmCommand not pinned by hash: packages/grpc-js-xds/scripts/xds.sh:46
- Warn: downloadThenRun not pinned by hash: run-tests.sh:20
- Warn: npmCommand not pinned by hash: run-tests.sh:42
- Warn: npmCommand not pinned by hash: run-tests.sh:67
- Warn: npmCommand not pinned by hash: setup_interop.sh:16
- Warn: npmCommand not pinned by hash: setup_interop.sh:17
- Warn: npmCommand not pinned by hash: setup_interop_purejs.sh:16
- Warn: npmCommand not pinned by hash: setup_interop_purejs.sh:17
- Warn: npmCommand not pinned by hash: test/client-libraries-integration/init.sh:16
- Warn: npmCommand not pinned by hash: test/client-libraries-integration/init.sh:23
- Warn: npmCommand not pinned by hash: test/distrib/run-distrib-test.sh:29
- Warn: npmCommand not pinned by hash: test/distrib/run-distrib-test.sh:30
- Warn: npmCommand not pinned by hash: test/distrib/run-distrib-test.sh:31
- Info: 0 out of 8 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 3 containerImage dependencies pinned
- Info: 0 out of 17 npmCommand dependencies pinned
- Info: 0 out of 3 downloadThenRun dependencies pinned
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Score
6.6
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More