Gathering detailed insights and metrics for @stripe/stripe-js
Gathering detailed insights and metrics for @stripe/stripe-js
Installations
npm install @stripe/stripe-jsDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Min. Node Version
>=12.16
Releases
144
Languages
3
TypeScript
Shell
JavaScript
TypeScript (92.71%)
Shell (5.39%)
JavaScript (1.9%)
Developer
Download Statistics
Total Downloads
290,810,508
Last Day
455,627
Last Week
2,711,268
Last Month
11,351,707
Last Year
106,171,482
GitHub Statistics
MIT License
695 Stars
584 Commits
169 Forks
38 Watchers
169 Branches
3,127 Contributors
Updated on Jul 16, 2025
Maintainers
14
Package Meta Information
Latest Version
7.5.0
Package Id
@stripe/stripe-js@7.5.0
Unpacked Size
929.71 kB
Size
101.48 kB
File Count
151
Published on
Jul 16, 2025
Total Downloads
Cumulative downloads
Total Downloads
290,810,508
Last Day
45.5%
455,627
Compared to previous day
Last Week
7.2%
2,711,268
Compared to previous week
Last Month
3.4%
11,351,707
Compared to previous month
Last Year
43.1%
106,171,482
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dev Dependencies
24
@arethetypeswrong/cli@babel/core@babel/preset-env@rollup/plugin-replace@types/jest@typescript-eslint/eslint-plugin@typescript-eslint/parserbabel-eslintbabel-jestconditional-type-checkseslinteslint-config-prettiereslint-plugin-importeslint-plugin-jesteslint-plugin-prettierjestprettierrimrafrolluprollup-plugin-babelrollup-plugin-typescript2ts-jesttypescriptzx
Stripe.js as a CommonJS module or ES module
This package allows Stripe.js to be imported as a CommonJS module or ES module.
Note: To be
PCI compliant,
you must load Stripe.js directly from https://js.stripe.com. You cannot
include it in a bundle or host it yourself. This package wraps the global
Stripe function provided by the Stripe.js script as an ES module.
Calling loadStripe always loads the latest version of Stripe.js, regardless of
which version of @stripe/stripe-js you use. Updates for this package only
impact tooling around the loadStripe helper itself and the TypeScript type
definitions provided for Stripe.js. Updates do not affect runtime availability
of features of Stripe.js.
Minimum requirements
- Node.js: v12.16
- TypeScript: v.3.1.1
Installation
Use npm to install the Stripe.js module:
1npm install @stripe/stripe-js
Versioning
Each @stripe/stripe-js version is pinned to a specific
Stripe.js version. The
pinned versions are as follows:
| @stripe/stripe-js | Stripe.js |
|---|---|
| <6 | v3 |
| v6 | acacia |
| v7 | basil |
Usage
loadStripe
This function returns a Promise that resolves with a newly created Stripe
object once Stripe.js has loaded. It takes the same parameters passed when
directly
initializing a Stripe instance. If
necessary, it will load Stripe.js for you by inserting the Stripe.js script tag.
If you call loadStripe in a server environment it will resolve to null.
1import {loadStripe} from '@stripe/stripe-js'; 2 3const stripe = await loadStripe('pk_test_TYooMQauvdEDq54NiTphI7jx');
We’ve placed a random API key in this example. Replace it with your actual publishable API keys to test this code through your Stripe account.
For more information on how to use Stripe.js, please refer to the Stripe.js API reference or learn to accept a payment with Stripe.
If you have deployed a Content Security Policy, make sure to include Stripe.js in your directives.
TypeScript support
This package includes TypeScript declarations for Stripe.js. We support projects using TypeScript versions >= 3.1.
Some methods in Stripe.js accept and return objects from the
Stripe API. The type declarations in
@stripe/stripe-js for these objects in will always track the
latest version of the Stripe API. If
you would like to use these types but are using an older version of the Stripe
API, we recommend
updating to the latest version,
or ignoring and overriding the type definitions as necessary.
Note that we may release new minor and patch versions of
@stripe/stripe-js with small but backwards-incompatible fixes to the type
declarations. These changes will not affect Stripe.js itself.
Ensuring Stripe.js is available everywhere
To best leverage Stripe’s advanced fraud functionality, ensure that Stripe.js is loaded on every page, not just your checkout page. This allows Stripe to detect suspicious behavior that may be indicative of fraud as customers browse your website.
By default, this module will insert a <script> tag that loads Stripe.js from
https://js.stripe.com. This happens as a side effect immediately upon
importing this module. If you utilize code splitting or only include your
JavaScript app on your checkout page, the Stripe.js script will only be
available in parts of your site. To ensure Stripe.js is available everywhere,
you can perform either of the following steps:
Import as a side effect
Import @stripe/stripe-js as a side effect in code that will be included
throughout your site (e.g. your root module). This will make sure the Stripe.js
script tag is inserted immediately upon page load.
1import '@stripe/stripe-js';
Manually include the script tag
Manually add the Stripe.js script tag to the <head> of each page on your site.
If an existing script tag is already present, this module will not insert a new
one. When you call loadStripe, it will use the existing script tag.
1<!-- Somewhere in your site's <head> --> 2<script src="https://js.stripe.com/basil/stripe.js" async></script>
Importing loadStripe without side effects
If you would like to use loadStripe in your application, but defer loading the
Stripe.js script until loadStripe is first called, use the alternative
@stripe/stripe-js/pure import module:
1// CommonJS module import 2const {loadStripe} = require('@stripe/stripe-js/pure'); 3// ES module import 4import {loadStripe} from '@stripe/stripe-js/pure'; 5 6// Stripe.js will not be loaded until `loadStripe` is called 7const stripe = await loadStripe('pk_test_TYooMQauvdEDq54NiTphI7jx');
Disabling advanced fraud detection signals
If you would like to
disable advanced fraud detection
altogether, use loadStripe.setLoadParameters:
1// CommonJS module import 2const {loadStripe} = require('@stripe/stripe-js/pure'); 3// ES module import 4import {loadStripe} from '@stripe/stripe-js/pure'; 5 6loadStripe.setLoadParameters({advancedFraudSignals: false}); 7const stripe = await loadStripe('pk_test_TYooMQauvdEDq54NiTphI7jx');
The loadStripe.setLoadParameters function is only available when importing
loadStripe from @stripe/stripe-js/pure.
Stripe.js Documentation
No vulnerabilities found.
Reason
16 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/stripe/.github/SECURITY.md:1
- Info: Found linked content: github.com/stripe/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/stripe/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/stripe/.github/SECURITY.md:1
Reason
Found 20/30 approved changesets -- score normalized to 6
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'master'
- Info: 'force pushes' disabled on branch 'master'
- Info: 'branch protection settings apply to administrators' is required to merge on branch 'master'
- Warn: required approving review count is 1 on branch 'master'
- Warn: codeowners review is not required on branch 'master'
- Warn: no status checks found to merge onto branch 'master'
- Info: PRs are required in order to make changes on branch 'master'
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/stale.yml:1
- Warn: no topLevel permission defined: .github/workflows/test.yml:1
- Info: no jobLevel write permissions found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/stripe/stripe-js/stale.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/stripe/stripe-js/test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/stripe/stripe-js/test.yml/master?enable=pin
- Info: 0 out of 3 GitHub-owned GitHubAction dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 20 are checked with a SAST tool
Reason
52 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-7r28-3m3f-r2pr
- Warn: Project is vulnerable to: GHSA-r8j5-h5cx-65gg
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-92xj-mqp7-vmcj
- Warn: Project is vulnerable to: GHSA-wxgw-qj99-44c2
- Warn: Project is vulnerable to: GHSA-5rrq-pxf6-6jx5
- Warn: Project is vulnerable to: GHSA-8fr3-hfg3-gpgp
- Warn: Project is vulnerable to: GHSA-gf8q-jrpm-jvxq
- Warn: Project is vulnerable to: GHSA-2r2c-g63r-vccr
- Warn: Project is vulnerable to: GHSA-cfm4-qjh2-4765
- Warn: Project is vulnerable to: GHSA-x4jg-mjrx-434g
- Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
- Warn: Project is vulnerable to: GHSA-h7cp-r72f-jxh6
- Warn: Project is vulnerable to: GHSA-v62p-rq8g-8h59
- Warn: Project is vulnerable to: GHSA-566m-qj78-rww5
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-hwj9-h5mp-3pm3
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-whgm-jr23-g3j9
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-w8qv-6jwh-64r5
- Warn: Project is vulnerable to: GHSA-6h5x-7c5m-7cr7
- Warn: Project is vulnerable to: GHSA-ww39-953v-wcq6
- Warn: Project is vulnerable to: GHSA-pfq8-rq6v-vf5m
- Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-76p3-8jx3-jpfq
- Warn: Project is vulnerable to: GHSA-3rfm-jhwj-7488
- Warn: Project is vulnerable to: GHSA-hhq3-ff78-jv3g
- Warn: Project is vulnerable to: GHSA-wr3j-pwj9-hqq6
- Warn: Project is vulnerable to: GHSA-4v9v-hfq4-rm2v
- Warn: Project is vulnerable to: GHSA-9jgg-88mc-972h
- Warn: Project is vulnerable to: GHSA-5fw9-fq32-wv5p
- Warn: Project is vulnerable to: GHSA-jgrx-mgxx-jf9v
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp
Score
5.2
/10
Last Scanned on 2025-07-07
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More