Gathering detailed insights and metrics for canvas
@antv/g-canvas
A renderer implemented by Canvas 2D API
stackblur-canvas
Fast and almost Gaussian blur by Mario Klingemann
@sentry-internal/replay-canvas
Replay canvas integration
blueimp-canvas-to-blob
Canvas to Blob is a polyfill for the standard JavaScript canvas.toBlob method. It can be used to create Blob objects from an HTML canvas element.
Node canvas is a Cairo backed Canvas implementation for NodeJS.
npm install canvasTypescript
Module System
Min. Node Version
Node Version
NPM Version
JavaScript (65.95%)
C++ (31.35%)
C (1.64%)
Python (0.78%)
TypeScript (0.17%)
CSS (0.06%)
HTML (0.05%)
Verify real, reachable, and deliverable emails with instant MX records, SMTP checks, and disposable email detection.
Total Downloads
307,139,178
Last Day
624,943
Last Week
3,277,158
Last Month
13,337,700
Last Year
116,640,058
10,371 Stars
1,964 Commits
1,185 Forks
273 Watchers
7 Branches
343 Contributors
Updated on Mar 13, 2025
Minified
Minified + Gzipped
Latest Version
3.1.0
Package Id
canvas@3.1.0
Unpacked Size
398.42 kB
Size
94.89 kB
File Count
59
NPM Version
10.9.2
Node Version
23.4.0
Published on
Jan 22, 2025
Cumulative downloads
Total Downloads
Last Day
8.1%
624,943
Compared to previous day
Last Week
7.8%
3,277,158
Compared to previous week
Last Month
10.8%
13,337,700
Compared to previous month
Last Year
81.4%
116,640,058
Compared to previous year
2
node-canvas is a Cairo-backed Canvas implementation for Node.js.
1$ npm install canvas
By default, pre-built binaries will be downloaded if you're on one of the following platforms:
If you want to build from source, use npm install --build-from-source and see the Compiling section below.
The minimum version of Node.js required is 18.12.0.
If you don't have a supported OS or processor architecture, or you use --build-from-source, the module will be compiled on your system. This requires several dependencies, including Cairo and Pango.
For detailed installation information, see the wiki. One-line installation instructions for common OSes are below. Note that libgif/giflib, librsvg and libjpeg are optional and only required if you need GIF, SVG and JPEG support, respectively. Cairo v1.10.0 or later is required.
| OS | Command |
|---|---|
| macOS | Using Homebrew:brew install pkg-config cairo pango libpng jpeg giflib librsvg pixman python-setuptools |
| Ubuntu | sudo apt-get install build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev |
| Fedora | sudo yum install gcc-c++ cairo-devel pango-devel libjpeg-turbo-devel giflib-devel |
| Solaris | pkgin install cairo pango pkg-config xproto renderproto kbproto xextproto |
| OpenBSD | doas pkg_add cairo pango png jpeg giflib |
| Windows | See the wiki |
| Others | See the wiki |
Mac OS X v10.11+: If you have recently updated to Mac OS X v10.11+ and are experiencing trouble when compiling, run the following command: xcode-select --install. Read more about the problem on Stack Overflow.
If you have xcode 10.0 or higher installed, in order to build from source you need NPM 6.4.1 or higher.
1const { createCanvas, loadImage } = require('canvas') 2const canvas = createCanvas(200, 200) 3const ctx = canvas.getContext('2d') 4 5// Write "Awesome!" 6ctx.font = '30px Impact' 7ctx.rotate(0.1) 8ctx.fillText('Awesome!', 50, 100) 9 10// Draw line under text 11var text = ctx.measureText('Awesome!') 12ctx.strokeStyle = 'rgba(0,0,0,0.5)' 13ctx.beginPath() 14ctx.lineTo(50, 102) 15ctx.lineTo(50 + text.width, 102) 16ctx.stroke() 17 18// Draw cat with lime helmet 19loadImage('examples/images/lime-cat.jpg').then((image) => { 20 ctx.drawImage(image, 50, 0, 70, 70) 21 22 console.log('<img src="' + canvas.toDataURL() + '" />') 23})
See the changelog for a guide to upgrading from 1.x to 2.x.
For version 1.x documentation, see the v1.x branch.
This project is an implementation of the Web Canvas API and implements that API as closely as possible. For API documentation, please visit Mozilla Web Canvas API. (See Compatibility Status for the current API compliance.) All utility methods and non-standard APIs are documented below.
1createCanvas(width: number, height: number, type?: 'PDF'|'SVG') => Canvas
Creates a Canvas instance. This method works in both Node.js and Web browsers, where there is no Canvas constructor. (See browser.js for the implementation that runs in browsers.)
1const { createCanvas } = require('canvas') 2const mycanvas = createCanvas(200, 200) 3const myPDFcanvas = createCanvas(600, 800, 'pdf') // see "PDF Support" section
1createImageData(width: number, height: number) => ImageData
2createImageData(data: Uint8ClampedArray, width: number, height?: number) => ImageData
3// for alternative pixel formats:
4createImageData(data: Uint16Array, width: number, height?: number) => ImageData
Creates an ImageData instance. This method works in both Node.js and Web browsers.
1const { createImageData } = require('canvas') 2const width = 20, height = 20 3const arraySize = width * height * 4 4const mydata = createImageData(new Uint8ClampedArray(arraySize), width)
1loadImage() => Promise<Image>
Convenience method for loading images. This method works in both Node.js and Web browsers.
1const { loadImage } = require('canvas') 2const myimg = loadImage('http://server.com/image.png') 3 4myimg.then(() => { 5 // do something with image 6}).catch(err => { 7 console.log('oh no!', err) 8}) 9 10// or with async/await: 11const myimg = await loadImage('http://server.com/image.png') 12// do something with image
1registerFont(path: string, { family: string, weight?: string, style?: string }) => void
To use a font file that is not installed as a system font, use registerFont() to register the font with Canvas.
1const { registerFont, createCanvas } = require('canvas') 2registerFont('comicsans.ttf', { family: 'Comic Sans' }) 3 4const canvas = createCanvas(500, 500) 5const ctx = canvas.getContext('2d') 6 7ctx.font = '12px "Comic Sans"' 8ctx.fillText('Everyone hates this font :(', 250, 10)
The second argument is an object with properties that resemble the CSS properties that are specified in @font-face rules. You must specify at least family. weight, and style are optional and default to 'normal'.
1deregisterAllFonts() => void
Use deregisterAllFonts to unregister all fonts that have been previously registered. This method is useful when you want to remove all registered fonts, such as when using the canvas in tests
1const { registerFont, createCanvas, deregisterAllFonts } = require('canvas') 2 3describe('text rendering', () => { 4 afterEach(() => { 5 deregisterAllFonts(); 6 }) 7 it('should render text with Comic Sans', () => { 8 registerFont('comicsans.ttf', { family: 'Comic Sans' }) 9 10 const canvas = createCanvas(500, 500) 11 const ctx = canvas.getContext('2d') 12 13 ctx.font = '12px "Comic Sans"' 14 ctx.fillText('Everyone loves this font :)', 250, 10) 15 16 // assertScreenshot() 17 }) 18})
1img.src: string|Buffer
As in browsers, img.src can be set to a data: URI or a remote URL. In addition, node-canvas allows setting src to a local file path or Buffer instance.
1const { Image } = require('canvas') 2 3// From a buffer: 4fs.readFile('images/squid.png', (err, squid) => { 5 if (err) throw err 6 const img = new Image() 7 img.onload = () => ctx.drawImage(img, 0, 0) 8 img.onerror = err => { throw err } 9 img.src = squid 10}) 11 12// From a local file path: 13const img = new Image() 14img.onload = () => ctx.drawImage(img, 0, 0) 15img.onerror = err => { throw err } 16img.src = 'images/squid.png' 17 18// From a remote URL: 19img.src = 'http://picsum.photos/200/300' 20// ... as above 21 22// From a `data:` URI: 23img.src = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==' 24// ... as above
Note: In some cases, img.src= is currently synchronous. However, you should always use img.onload and img.onerror, as we intend to make img.src= always asynchronous as it is in browsers. See https://github.com/Automattic/node-canvas/issues/1007.
1img.dataMode: number
Applies to JPEG images drawn to PDF canvases only.
Setting img.dataMode = Image.MODE_MIME or Image.MODE_MIME|Image.MODE_IMAGE enables MIME data tracking of images. When MIME data is tracked, PDF canvases can embed JPEGs directly into the output, rather than re-encoding into PNG. This can drastically reduce filesize and speed up rendering.
1const { Image, createCanvas } = require('canvas') 2const canvas = createCanvas(w, h, 'pdf') 3const img = new Image() 4img.dataMode = Image.MODE_IMAGE // Only image data tracked 5img.dataMode = Image.MODE_MIME // Only mime data tracked 6img.dataMode = Image.MODE_MIME | Image.MODE_IMAGE // Both are tracked
If working with a non-PDF canvas, image data must be tracked; otherwise the output will be junk.
Enabling mime data tracking has no benefits (only a slow down) unless you are generating a PDF.
1canvas.toBuffer((err: Error|null, result: Buffer) => void, mimeType?: string, config?: any) => void
2canvas.toBuffer(mimeType?: string, config?: any) => Buffer
Creates a Buffer object representing the image contained in the canvas.
raw or for PDF or SVG canvases.image/png, image/jpeg (if node-canvas was built with JPEG support), raw (unencoded data in BGRA order on little-endian (most) systems, ARGB on big-endian systems; top-to-bottom), application/pdf (for PDF canvases) and image/svg+xml (for SVG canvases). Defaults to image/png for image canvases, or the corresponding type for PDF or SVG canvas.For image/jpeg, an object specifying the quality (0 to 1), if progressive compression should be used and/or if chroma subsampling should be used: {quality: 0.75, progressive: false, chromaSubsampling: true}. All properties are optional.
For image/png, an object specifying the ZLIB compression level (between 0 and 9), the compression filter(s), the palette (indexed PNGs only), the the background palette index (indexed PNGs only) and/or the resolution (ppi): {compressionLevel: 6, filters: canvas.PNG_ALL_FILTERS, palette: undefined, backgroundIndex: 0, resolution: undefined}. All properties are optional.
Note that the PNG format encodes the resolution in pixels per meter, so if you specify 96, the file will encode 3780 ppm (~96.01 ppi). The resolution is undefined by default to match common browser behavior.
For application/pdf, an object specifying optional document metadata: {title: string, author: string, subject: string, keywords: string, creator: string, creationDate: Date, modDate: Date}. All properties are optional and default to undefined, except for creationDate, which defaults to the current date. Adding metadata requires Cairo 1.16.0 or later.
For a description of these properties, see page 550 of PDF 32000-1:2008.
Note that there is no standard separator for keywords. A space is recommended because it is in common use by other applications, and Cairo will enclose the list of keywords in quotes if a comma or semicolon is used.
Return value
If no callback is provided, a Buffer. If a callback is provided, none.
1// Default: buf contains a PNG-encoded image
2const buf = canvas.toBuffer()
3
4// PNG-encoded, zlib compression level 3 for faster compression but bigger files, no filtering
5const buf2 = canvas.toBuffer('image/png', { compressionLevel: 3, filters: canvas.PNG_FILTER_NONE })
6
7// JPEG-encoded, 50% quality
8const buf3 = canvas.toBuffer('image/jpeg', { quality: 0.5 })
9
10// Asynchronous PNG
11canvas.toBuffer((err, buf) => {
12 if (err) throw err // encoding failed
13 // buf is PNG-encoded image
14})
15
16canvas.toBuffer((err, buf) => {
17 if (err) throw err // encoding failed
18 // buf is JPEG-encoded image at 95% quality
19}, 'image/jpeg', { quality: 0.95 })
20
21// BGRA pixel values, native-endian
22const buf4 = canvas.toBuffer('raw')
23const { stride, width } = canvas
24// In memory, this is `canvas.height * canvas.stride` bytes long.
25// The top row of pixels, in BGRA order on little-endian hardware,
26// left-to-right, is:
27const topPixelsBGRALeftToRight = buf4.slice(0, width * 4)
28// And the third row is:
29const row3 = buf4.slice(2 * stride, 2 * stride + width * 4)
30
31// SVG and PDF canvases
32const myCanvas = createCanvas(w, h, 'pdf')
33myCanvas.toBuffer() // returns a buffer containing a PDF-encoded canvas
34// With optional metadata:
35myCanvas.toBuffer('application/pdf', {
36 title: 'my picture',
37 keywords: 'node.js demo cairo',
38 creationDate: new Date()
39})
1canvas.createPNGStream(config?: any) => ReadableStream
Creates a ReadableStream that emits PNG-encoded data.
config An object specifying the ZLIB compression level (between 0 and 9), the compression filter(s), the palette (indexed PNGs only) and/or the background palette index (indexed PNGs only): {compressionLevel: 6, filters: canvas.PNG_ALL_FILTERS, palette: undefined, backgroundIndex: 0, resolution: undefined}. All properties are optional.1const fs = require('fs') 2const out = fs.createWriteStream(__dirname + '/test.png') 3const stream = canvas.createPNGStream() 4stream.pipe(out) 5out.on('finish', () => console.log('The PNG file was created.'))
To encode indexed PNGs from canvases with pixelFormat: 'A8' or 'A1', provide an options object:
1const palette = new Uint8ClampedArray([ 2 //r g b a 3 0, 50, 50, 255, // index 1 4 10, 90, 90, 255, // index 2 5 127, 127, 255, 255 6 // ... 7]) 8canvas.createPNGStream({ 9 palette: palette, 10 backgroundIndex: 0 // optional, defaults to 0 11})
1canvas.createJPEGStream(config?: any) => ReadableStream
Creates a ReadableStream that emits JPEG-encoded data.
Note: At the moment, createJPEGStream() is synchronous under the hood. That is, it runs in the main thread, not in the libuv threadpool.
config an object specifying the quality (0 to 1), if progressive compression should be used and/or if chroma subsampling should be used: {quality: 0.75, progressive: false, chromaSubsampling: true}. All properties are optional.1const fs = require('fs') 2const out = fs.createWriteStream(__dirname + '/test.jpeg') 3const stream = canvas.createJPEGStream() 4stream.pipe(out) 5out.on('finish', () => console.log('The JPEG file was created.')) 6 7// Disable 2x2 chromaSubsampling for deeper colors and use a higher quality 8const stream = canvas.createJPEGStream({ 9 quality: 0.95, 10 chromaSubsampling: false 11})
1canvas.createPDFStream(config?: any) => ReadableStream
config an object specifying optional document metadata: {title: string, author: string, subject: string, keywords: string, creator: string, creationDate: Date, modDate: Date}. See toBuffer() for more information. Adding metadata requires Cairo 1.16.0 or later.Applies to PDF canvases only. Creates a ReadableStream that emits the encoded PDF. canvas.toBuffer() also produces an encoded PDF, but createPDFStream() can be used to reduce memory usage.
This is a standard API, but several non-standard calls are supported. The full list of supported calls is:
1dataUrl = canvas.toDataURL() // defaults to PNG
2dataUrl = canvas.toDataURL('image/png')
3dataUrl = canvas.toDataURL('image/jpeg')
4dataUrl = canvas.toDataURL('image/jpeg', quality) // quality from 0 to 1
5canvas.toDataURL((err, png) => { }) // defaults to PNG
6canvas.toDataURL('image/png', (err, png) => { })
7canvas.toDataURL('image/jpeg', (err, jpeg) => { }) // sync JPEG is not supported
8canvas.toDataURL('image/jpeg', {...opts}, (err, jpeg) => { }) // see Canvas#createJPEGStream for valid options
9canvas.toDataURL('image/jpeg', quality, (err, jpeg) => { }) // spec-following; quality from 0 to 11context.patternQuality: 'fast'|'good'|'best'|'nearest'|'bilinear'
Defaults to 'good'. Affects pattern (gradient, image, etc.) rendering quality.
1context.quality: 'fast'|'good'|'best'|'nearest'|'bilinear'
Defaults to 'good'. Like patternQuality, but applies to transformations affecting more than just patterns.
1context.textDrawingMode: 'path'|'glyph'
Defaults to 'path'. The effect depends on the canvas type:
Standard (image) glyph and path both result in rasterized text. Glyph mode is faster than path, but may result in lower-quality text, especially when rotated or translated.
PDF glyph will embed text instead of paths into the PDF. This is faster to encode, faster to open with PDF viewers, yields a smaller file size and makes the text selectable. The subset of the font needed to render the glyphs will be embedded in the PDF. This is usually the mode you want to use with PDF canvases.
SVG glyph does not cause <text> elements to be produced as one might expect (cairo bug). Rather, glyph will create a <defs> section with a <symbol> for each glyph, then those glyphs be reused via <use> elements. path mode creates a <path> element for each text string. glyph mode is faster and yields a smaller file size.
In glyph mode, ctx.strokeText() and ctx.fillText() behave the same (aside from using the stroke and fill style, respectively).
This property is tracked as part of the canvas state in save/restore.
In addition to all of the standard global composite operations defined by the Canvas specification, the 'saturate' operation is also available.
1context.antialias: 'default'|'none'|'gray'|'subpixel'
Sets the anti-aliasing mode.
node-canvas can create PDF documents instead of images. The canvas type must be set when creating the canvas as follows:
1const canvas = createCanvas(200, 500, 'pdf')
An additional method .addPage() is then available to create multiple page PDFs:
1// On first page
2ctx.font = '22px Helvetica'
3ctx.fillText('Hello World', 50, 80)
4
5ctx.addPage()
6// Now on second page
7ctx.font = '22px Helvetica'
8ctx.fillText('Hello World 2', 50, 80)
9
10canvas.toBuffer() // returns a PDF file
11canvas.createPDFStream() // returns a ReadableStream that emits a PDF
12// With optional document metadata (requires Cairo 1.16.0):
13canvas.toBuffer('application/pdf', {
14 title: 'my picture',
15 keywords: 'node.js demo cairo',
16 creationDate: new Date()
17})It is also possible to create pages with different sizes by passing width and height to the .addPage() method:
1ctx.font = '22px Helvetica' 2ctx.fillText('Hello World', 50, 80) 3ctx.addPage(400, 800) 4 5ctx.fillText('Hello World 2', 50, 80)
It is possible to add hyperlinks using .beginTag() and .endTag():
1ctx.beginTag('Link', "uri='https://google.com'") 2ctx.font = '22px Helvetica' 3ctx.fillText('Hello World', 50, 80) 4ctx.endTag('Link')
Or with a defined rectangle:
1ctx.beginTag('Link', "uri='https://google.com' rect=[50 80 100 20]") 2ctx.endTag('Link')
Note that the syntax for attributes is unique to Cairo. See cairo_tag_begin for the full documentation.
You can create areas on the canvas using the "cairo.dest" tag, and then link to them using the "Link" tag with the dest= attribute. You can also define PDF structure for accessibility by using tag names like "P", "H1", and "TABLE". The standard tags are defined in §14.8.4 of the PDF 1.7 specification.
See also:
node-canvas can create SVG documents instead of images. The canvas type must be set when creating the canvas as follows:
1const canvas = createCanvas(200, 500, 'svg')
2// Use the normal primitives.
3fs.writeFileSync('out.svg', canvas.toBuffer())If librsvg is available when node-canvas is installed, node-canvas can render SVG images to your canvas context. This currently works by rasterizing the SVG image (i.e. drawing an SVG image to an SVG canvas will not preserve the SVG data).
1const img = new Image() 2img.onload = () => ctx.drawImage(img, 0, 0) 3img.onerror = err => { throw err } 4img.src = './example.svg'
node-canvas has experimental support for additional pixel formats, roughly following the Canvas color space proposal.
1const canvas = createCanvas(200, 200) 2const ctx = canvas.getContext('2d', { pixelFormat: 'A8' })
By default, canvases are created in the RGBA32 format, which corresponds to the native HTML Canvas behavior. Each pixel is 32 bits. The JavaScript APIs that involve pixel data (getImageData, putImageData) store the colors in the order {red, green, blue, alpha} without alpha pre-multiplication. (The C++ API stores the colors in the order {alpha, red, green, blue} in native-endian ordering, with alpha pre-multiplication.)
These additional pixel formats have experimental support:
RGB24 Like RGBA32, but the 8 alpha bits are always opaque. This format is always used if the alpha context attribute is set to false (i.e. canvas.getContext('2d', {alpha: false})). This format can be faster than RGBA32 because transparency does not need to be calculated.A8 Each pixel is 8 bits. This format can either be used for creating grayscale images (treating each byte as an alpha value), or for creating indexed PNGs (treating each byte as a palette index) (see the example using alpha values with fillStyle and the example using imageData).RGB16_565 Each pixel is 16 bits, with red in the upper 5 bits, green in the middle 6 bits, and blue in the lower 5 bits, in native platform endianness. Some hardware devices and frame buffers use this format. Note that PNG does not support this format; when creating a PNG, the image will be converted to 24-bit RGB. This format is thus suboptimal for generating PNGs. ImageData instances for this mode use a Uint16Array instead of a Uint8ClampedArray.A1 Each pixel is 1 bit, and pixels are packed together into 32-bit quantities. The ordering of the bits matches the endianness of the
platform: on a little-endian machine, the first pixel is the least-significant bit. This format can be used for creating single-color images. Support for this format is incomplete, see note below.RGB30 Each pixel is 30 bits, with red in the upper 10, green in the middle 10, and blue in the lower 10. (Requires Cairo 1.12 or later.) Support for this format is incomplete, see note below.Notes and caveats:
Using a non-default format can affect the behavior of APIs that involve pixel data:
context2d.createImageData The size of the array returned depends on the number of bit per pixel for the underlying image data format, per the above descriptions.context2d.getImageData The format of the array returned depends on the underlying image mode, per the above descriptions. Be aware of platform endianness, which can be determined using node.js's os.endianness()
function.context2d.putImageData As above.A1 and RGB30 do not yet support getImageData or putImageData. Have a use case and/or opinion on working with these formats? Open an issue and let us know! (See #935.)
A1, A8, RGB30 and RGB16_565 with shadow blurs may crash or not render properly.
The ImageData(width, height) and ImageData(Uint8ClampedArray, width) constructors assume 4 bytes per pixel. To create an ImageData instance with a different number of bytes per pixel, use new ImageData(new Uint8ClampedArray(size), width, height) or new ImageData(new Uint16ClampedArray(size), width, height).
First make sure you've built the latest version. Get all the deps you need (see compiling above), and run:
npm install --build-from-source
For visual tests: npm run test-server and point your browser to http://localhost:4000.
For unit tests: npm run test.
Benchmarks live in the benchmarks directory.
Examples line in the examples directory. Most produce a png image of the same name, and others such as live-clock.js launch an HTTP server to be viewed in the browser.
(The MIT License)
Copyright (c) 2010 LearnBoost, and contributors <dev@learnboost.com>
Copyright (c) 2014 Automattic, Inc and contributors <dev@automattic.com>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
See license
Stable Version
1
8.8/10
Summary
Buffer overflow in canvas
Affected Versions
< 1.6.11
Patched Versions
1.6.11
1
0/10
Summary
Denial of Service in canvas
Affected Versions
< 1.6.10
Patched Versions
1.6.10
Reason
19 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
Found 9/29 approved changesets -- score normalized to 3
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
Reason
project is not fuzzed
Details
Reason
license file not detected
Details
Reason
security policy file not detected
Details
Reason
branch protection not enabled on development/release branches
Details
Reason
Project has not signed or included provenance with any releases.
Details
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
Score
Last Scanned on 2025-03-10
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More