Gathering detailed insights and metrics for electron
Gathering detailed insights and metrics for electron
:electron: Build cross-platform desktop apps with JavaScript, HTML, and CSS Build cross-platform desktop apps with JavaScript, HTML, and CSS
Installations
npm install electronDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Min. Node Version
>= 12.20.55
Node Version
22.15.0
NPM Version
10.9.2
Releases
1,672
electron v34.5.5
v34.5.5
Updated on May 07, 2025
electron v35.3.0
v35.3.0
Updated on May 07, 2025
electron v36.2.0
v36.2.0
Updated on May 07, 2025
electron v37.0.0-alpha.3
v37.0.0-alpha.3
Updated on May 05, 2025
electron v37.0.0-alpha.2
v37.0.0-alpha.2
Updated on May 02, 2025
electron v36.1.0
v36.1.0
Updated on May 02, 2025
Languages
10
C++
TypeScript
Objective-C++
JavaScript
Python
Objective-C
HTML
Shell
C
CSS
C++ (56.74%)
TypeScript (32.54%)
Objective-C++ (5.73%)
JavaScript (2.11%)
Python (1.9%)
Objective-C (0.61%)
HTML (0.17%)
Shell (0.13%)
C (0.04%)
CSS (0.03%)
Developer
Download Statistics
Total Downloads
185,781,352
Last Day
195,002
Last Week
1,053,727
Last Month
4,645,679
Last Year
41,917,343
GitHub Statistics
MIT License
116,672 Stars
29,299 Commits
16,023 Forks
2,815 Watchers
275 Branches
1,295 Contributors
Updated on May 09, 2025
Bundle Size
222.00 B
Minified
192.00 B
Minified + Gzipped
Maintainers
2
Package Meta Information
Latest Version
36.2.0
Package Id
electron@36.2.0
Unpacked Size
1.01 MB
Size
172.33 kB
File Count
8
NPM Version
10.9.2
Node Version
22.15.0
Published on
May 07, 2025
Total Downloads
Cumulative downloads
Total Downloads
185,781,352
Last Day
25.2%
195,002
Compared to previous day
Last Week
0.2%
1,053,727
Compared to previous week
Last Month
-5.3%
4,645,679
Compared to previous month
Last Year
15.4%
41,917,343
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
3
:memo: Available Translations: 🇨🇳 🇧🇷 🇪🇸 🇯🇵 🇷🇺 🇫🇷 🇺🇸 🇩🇪. View these docs in other languages on our Crowdin project.
The Electron framework lets you write cross-platform desktop applications using JavaScript, HTML and CSS. It is based on Node.js and Chromium and is used by the Visual Studio Code and many other apps.
Follow @electronjs on Twitter for important announcements.
This project adheres to the Contributor Covenant code of conduct. By participating, you are expected to uphold this code. Please report unacceptable behavior to coc@electronjs.org.
Installation
To install prebuilt Electron binaries, use npm.
The preferred method is to install Electron as a development dependency in your
app:
1npm install electron --save-dev
For more installation options and troubleshooting tips, see installation. For info on how to manage Electron versions in your apps, see Electron versioning.
Platform support
Each Electron release provides binaries for macOS, Windows, and Linux.
- macOS (Big Sur and up): Electron provides 64-bit Intel and Apple Silicon / ARM binaries for macOS.
- Windows (Windows 10 and up): Electron provides
ia32(x86),x64(amd64), andarm64binaries for Windows. Windows on ARM support was added in Electron 5.0.8. Support for Windows 7, 8 and 8.1 was removed in Electron 23, in line with Chromium's Windows deprecation policy. - Linux: The prebuilt binaries of Electron are built on Ubuntu 20.04. They have also been verified to work on:
- Ubuntu 18.04 and newer
- Fedora 32 and newer
- Debian 10 and newer
Quick start & Electron Fiddle
Use Electron Fiddle
to build, run, and package small Electron experiments, to see code examples for all of Electron's APIs, and
to try out different versions of Electron. It's designed to make the start of your journey with
Electron easier.
Alternatively, clone and run the electron/electron-quick-start repository to see a minimal Electron app in action:
1git clone https://github.com/electron/electron-quick-start 2cd electron-quick-start 3npm install 4npm start
Resources for learning Electron
- electronjs.org/docs - All of Electron's documentation
- electron/fiddle - A tool to build, run, and package small Electron experiments
- electron/electron-quick-start - A very basic starter Electron app
- electronjs.org/community#boilerplates - Sample starter apps created by the community
Programmatic usage
Most people use Electron from the command line, but if you require electron inside
your Node app (not your Electron app) it will return the file path to the
binary. Use this to spawn Electron from Node scripts:
1const electron = require('electron') 2const proc = require('node:child_process') 3 4// will print something similar to /Users/maf/.../Electron 5console.log(electron) 6 7// spawn Electron 8const child = proc.spawn(electron)
Mirrors
See the Advanced Installation Instructions to learn how to use a custom mirror.
Documentation translations
We crowdsource translations for our documentation via Crowdin. We currently accept translations for Chinese (Simplified), French, German, Japanese, Portuguese, Russian, and Spanish.
Contributing
If you are interested in reporting/fixing issues and contributing directly to the code base, please see CONTRIBUTING.md for more information on what we're looking for and how to get started.
Community
Info on reporting bugs, getting help, finding third-party tools and sample apps, and more can be found on the Community page.
License
When using Electron logos, make sure to follow OpenJS Foundation Trademark Policy.
Critical
9.8/10
Summary
Chromium Remote Code Execution in electron
Affected Versions
>= 1.7.0, < 1.7.8
Patched Versions
1.7.8
Critical
9.8/10
Summary
Chromium Remote Code Execution in electron
Affected Versions
< 1.6.14
Patched Versions
1.6.14
Critical
9.7/10
Summary
Heap buffer overflow in GPU
Affected Versions
>= 19.0.0, < 19.1.8
Patched Versions
19.1.8
High
7.5/10
Summary
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled
Affected Versions
>= 23.0.0-alpha.1, < 23.0.0-alpha.2
Patched Versions
23.0.0-alpha.2
High
8.1/10
Summary
Electron vulnerable to remote command execution
Affected Versions
< 1.6.8
Patched Versions
1.6.8
High
8.8/10
Summary
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Affected Versions
>= 27.0.0-alpha.1, < 27.0.0-beta.8
Patched Versions
27.0.0-beta.8
High
8.8/10
Summary
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Affected Versions
>= 26.0.0, < 26.2.4
Patched Versions
26.2.4
High
8.8/10
Summary
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Affected Versions
>= 25.0.0, < 25.8.4
Patched Versions
25.8.4
High
8.8/10
Summary
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Affected Versions
>= 24.0.0, < 24.8.5
Patched Versions
24.8.5
High
8.8/10
Summary
Electron affected by libvpx's heap buffer overflow in vp8 encoding
Affected Versions
< 22.3.25
Patched Versions
22.3.25
High
8.8/10
Summary
libwebp: OOB write in BuildHuffmanTable
Affected Versions
>= 27.0.0-beta.1, < 27.0.0-beta.2
Patched Versions
27.0.0-beta.2
High
8.8/10
Summary
libwebp: OOB write in BuildHuffmanTable
Affected Versions
>= 26.0.0, < 26.2.1
Patched Versions
26.2.1
High
8.8/10
Summary
libwebp: OOB write in BuildHuffmanTable
Affected Versions
>= 25.0.0, < 25.8.1
Patched Versions
25.8.1
High
8.8/10
Summary
libwebp: OOB write in BuildHuffmanTable
Affected Versions
>= 24.0.0, < 24.8.3
Patched Versions
24.8.3
High
8.8/10
Summary
libwebp: OOB write in BuildHuffmanTable
Affected Versions
>= 22.0.0, < 22.3.24
Patched Versions
22.3.24
High
8.1/10
Summary
Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
Affected Versions
>= 1.8.0, < 1.8.4
Patched Versions
1.8.4
High
8.1/10
Summary
Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
Affected Versions
>= 1.7.0, < 1.7.13
Patched Versions
1.7.13
High
8.1/10
Summary
Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration
Affected Versions
>= 2.0.0-beta.1, < 2.0.0-beta.5
Patched Versions
2.0.0-beta.5
High
7.5/10
Summary
Electron's Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled
Affected Versions
>= 22.0.0-beta.1, < 22.0.1
Patched Versions
22.0.1
High
8.1/10
Summary
Electron webPreferences vulnerability can be used to perform remote code execution
Affected Versions
>= 3.0.0-beta.1, < 3.0.0-beta.7
Patched Versions
3.0.0-beta.7
Moderate
6.1/10
Summary
ASAR Integrity bypass via filetype confusion in electron
Affected Versions
>= 23.0.0-alpha.1, <= 23.3.13
Moderate
6.1/10
Summary
ASAR Integrity bypass via filetype confusion in electron
Affected Versions
>= 27.0.0-alpha.1, < 27.0.0-alpha.7
Patched Versions
27.0.0-alpha.7
Moderate
6.1/10
Summary
ASAR Integrity bypass via filetype confusion in electron
Affected Versions
>= 26.0.0-alpha.1, < 26.2.1
Patched Versions
26.2.1
Moderate
6.1/10
Summary
ASAR Integrity bypass via filetype confusion in electron
Affected Versions
>= 25.0.0-alpha.1, < 25.8.1
Patched Versions
25.8.1
Moderate
6.1/10
Summary
ASAR Integrity bypass via filetype confusion in electron
Affected Versions
>= 24.0.0-alpha.1, < 24.8.3
Patched Versions
24.8.3
Moderate
6.1/10
Summary
ASAR Integrity bypass via filetype confusion in electron
Affected Versions
< 22.3.24
Patched Versions
22.3.24
Moderate
4.3/10
Summary
Electron vulnerable to URL spoofing via PDFium
Affected Versions
>= 1.7.0, < 1.7.6
Patched Versions
1.7.6
Moderate
6.1/10
Summary
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd
Affected Versions
>= 26.0.0-alpha.1, < 26.0.0-beta.13
Patched Versions
26.0.0-beta.13
Moderate
6.1/10
Summary
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd
Affected Versions
>= 25.0.0-alpha.1, < 25.5.0
Patched Versions
25.5.0
Moderate
6.1/10
Summary
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd
Affected Versions
>= 24.0.0-alpha.1, < 24.7.1
Patched Versions
24.7.1
Moderate
6.1/10
Summary
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd
Affected Versions
>= 23.0.0-alpha.1, < 23.3.13
Patched Versions
23.3.13
Moderate
6.1/10
Summary
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd
Affected Versions
< 22.3.19
Patched Versions
22.3.19
Moderate
6/10
Summary
Electron context isolation bypass via nested unserializable return value
Affected Versions
>= 25.0.0-alpha.1, < 25.0.0-alpha.2
Patched Versions
25.0.0-alpha.2
Moderate
6/10
Summary
Electron context isolation bypass via nested unserializable return value
Affected Versions
>= 24.0.0-alpha.1, < 24.0.1
Patched Versions
24.0.1
Moderate
6/10
Summary
Electron context isolation bypass via nested unserializable return value
Affected Versions
>= 23.0.0-alpha.1, < 23.2.3
Patched Versions
23.2.3
Moderate
6/10
Summary
Electron context isolation bypass via nested unserializable return value
Affected Versions
< 22.3.6
Patched Versions
22.3.6
Moderate
5.4/10
Summary
Exfiltration of hashed SMB credentials on Windows via file:// redirect
Affected Versions
>= 19.0.0-beta.1, < 19.0.11
Patched Versions
19.0.11
Moderate
5.4/10
Summary
Exfiltration of hashed SMB credentials on Windows via file:// redirect
Affected Versions
>= 20.0.0-beta.1, < 20.0.1
Patched Versions
20.0.1
Moderate
5.4/10
Summary
Exfiltration of hashed SMB credentials on Windows via file:// redirect
Affected Versions
< 18.3.7
Patched Versions
18.3.7
Moderate
6.6/10
Summary
AutoUpdater module fails to validate certain nested components of the bundle
Affected Versions
>= 18.0.0-beta.1, <= 18.0.0-beta.5
Patched Versions
18.0.0-beta.6
Moderate
6.6/10
Summary
AutoUpdater module fails to validate certain nested components of the bundle
Affected Versions
>= 17.0.0, < 17.2.0
Patched Versions
17.2.0
Moderate
6.6/10
Summary
AutoUpdater module fails to validate certain nested components of the bundle
Affected Versions
>= 16.0.0, < 16.2.0
Patched Versions
16.2.0
Moderate
6.6/10
Summary
AutoUpdater module fails to validate certain nested components of the bundle
Affected Versions
< 15.5.0
Patched Versions
15.5.0
Low
2.2/10
Summary
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled
Affected Versions
>= 18.0.0-beta.1, <= 18.0.0-beta.5
Patched Versions
18.0.0-beta.6
Low
2.2/10
Summary
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled
Affected Versions
>= 17.0.0, < 17.2.0
Patched Versions
17.2.0
Low
2.2/10
Summary
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled
Affected Versions
>= 16.0.0, < 16.2.6
Patched Versions
16.2.6
Low
2.2/10
Summary
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled
Affected Versions
< 15.5.5
Patched Versions
15.5.5
Low
3.4/10
Summary
Renderers can obtain access to random bluetooth device without permission in Electron
Affected Versions
>= 17.0.0-alpha.1, <= 17.0.0-alpha.5
Patched Versions
17.0.0-alpha.6
Low
3.4/10
Summary
Renderers can obtain access to random bluetooth device without permission in Electron
Affected Versions
>= 16.0.0-beta.1, < 16.0.6
Patched Versions
16.0.6
Low
3.4/10
Summary
Renderers can obtain access to random bluetooth device without permission in Electron
Affected Versions
>= 15.0.0-beta.1, < 15.3.5
Patched Versions
15.3.5
Reason
30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
update tool detected
Details
- Info: detected update tool: Dependabot: .github/dependabot.yml:1
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Reason
project has 91 contributing companies or organizations
Details
- Info: found contributions from: 415bike, Abacus, AtomLinter, CatalystDefCon, EpicGames, GPMDP, HospitalRun, ProgRx, ScienceHackDayPDX, TryGhost, WhitestormJS, akavache, apple, apple-opensource-mirror, browserify, bucketplace, clibs, codeforamerica, colorjs, continuousauth, conventional-changelog, conventional-commits, crimethinc, crowdin-node, csv, csvconf, cyberwizardinstitute, d-w3c, dancejs, dashrlabs, dataprotocols, delta, electron, electron-forge, electron-userland, fellows, gamedevmcgill, github, gmusic-utils, government, greenheartgames, hackmcgill, harp-boilerplates, helsbk, hypermodules, jsfest, jsonlines, jus, legacy-buildpacks, libgit2, makenotion, microsoft, moose-team, mozilla, ncsoft, nice-registry, nko4, node-forward, nodeconf, nodejs, npm-dom, npm-flickr, npmhub, openjs-foundation, play, polyglotweekly, prebuild, queerjs, rainmeter, reactiveui, release-notifier, replicate, salesforce, scrum-gang, share, slackhq, sports, stackgl, sudoroom, tc39, the-collab-lab, tinyspeck, transmission, unemployed, unity8-team, update-readme, voxel, voxeljs, words, wwcodeportland, yue
Reason
dependency not pinned by hash detected -- score normalized to 9
Details
- Warn: npmCommand not pinned by hash: .github/workflows/issue-opened.yml:39
- Info: 35 out of 35 GitHub-owned GitHubAction dependencies pinned
- Info: 29 out of 29 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
badge detected: Passing
Reason
8 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-76p7-773f-r4q5
- Warn: Project is vulnerable to: GHSA-x4c5-c7rf-jjgv
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/branch-created.yml:19
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:270
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:271
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:269
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:350
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:351
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:349
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:231
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:232
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:233
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:249
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:250
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:251
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:310
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:311
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:312
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:330
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:331
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:332
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:45
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:213
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:214
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:215
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:290
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:291
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:292
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/build.yml:368
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/build.yml:369
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/build.yml:370
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/non-maintainer-dependency-change.yml:16
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/semantic.yml:16
- Warn: jobLevel 'statuses' permission set to 'write': .github/workflows/semantic.yml:17
- Warn: no topLevel permission defined: .github/workflows/archaeologist-dig.yml:1
- Info: found token with 'none' permissions: .github/workflows/branch-created.yml:1
- Warn: no topLevel permission defined: .github/workflows/build.yml:1
- Warn: no topLevel permission defined: .github/workflows/clean-src-cache.yml:1
- Info: found token with 'none' permissions: .github/workflows/issue-commented.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/issue-labeled.yml:8
- Info: found token with 'none' permissions: .github/workflows/issue-opened.yml:1
- Info: found token with 'none' permissions: .github/workflows/issue-transferred.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/issue-unlabeled.yml:8
- Warn: no topLevel permission defined: .github/workflows/linux-publish.yml:1
- Warn: no topLevel permission defined: .github/workflows/macos-publish.yml:1
- Info: found token with 'none' permissions: .github/workflows/non-maintainer-dependency-change.yml:1
- Warn: no topLevel permission defined: .github/workflows/pipeline-electron-build-and-test-and-nan.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/pipeline-electron-build-and-test.yml:63
- Info: topLevel 'issues' permission set to 'read': .github/workflows/pipeline-electron-build-and-test.yml:64
- Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/pipeline-electron-build-and-test.yml:65
- Warn: no topLevel permission defined: .github/workflows/pipeline-electron-docs-only.yml:1
- Warn: no topLevel permission defined: .github/workflows/pipeline-electron-lint.yml:1
- Warn: no topLevel permission defined: .github/workflows/pipeline-segment-electron-build.yml:1
- Warn: no topLevel permission defined: .github/workflows/pipeline-segment-electron-gn-check.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/pipeline-segment-electron-test.yml:34
- Info: topLevel 'issues' permission set to 'read': .github/workflows/pipeline-segment-electron-test.yml:35
- Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/pipeline-segment-electron-test.yml:36
- Warn: no topLevel permission defined: .github/workflows/pipeline-segment-node-nan-test.yml:1
- Info: found token with 'none' permissions: .github/workflows/pull-request-labeled.yml:1
- Info: topLevel permissions set to 'read-all': .github/workflows/scorecards.yml:11
- Info: topLevel 'contents' permission set to 'read': .github/workflows/semantic.yml:11
- Info: found token with 'none' permissions: .github/workflows/stable-prep-items.yml:1
- Info: found token with 'none' permissions: .github/workflows/stale.yml:1
- Warn: no topLevel permission defined: .github/workflows/windows-publish.yml:1
Reason
Project has not signed or included provenance with any releases.
Details
- Warn: release artifact v36.2.0 not signed: https://api.github.com/repos/electron/electron/releases/217088275
- Warn: release artifact v35.3.0 not signed: https://api.github.com/repos/electron/electron/releases/217088408
- Warn: release artifact v34.5.5 not signed: https://api.github.com/repos/electron/electron/releases/217088514
- Warn: release artifact v37.0.0-alpha.3 not signed: https://api.github.com/repos/electron/electron/releases/216495905
- Warn: release artifact v37.0.0-alpha.2 not signed: https://api.github.com/repos/electron/electron/releases/216069933
- Warn: release artifact v36.2.0 does not have provenance: https://api.github.com/repos/electron/electron/releases/217088275
- Warn: release artifact v35.3.0 does not have provenance: https://api.github.com/repos/electron/electron/releases/217088408
- Warn: release artifact v34.5.5 does not have provenance: https://api.github.com/repos/electron/electron/releases/217088514
- Warn: release artifact v37.0.0-alpha.3 does not have provenance: https://api.github.com/repos/electron/electron/releases/216495905
- Warn: release artifact v37.0.0-alpha.2 does not have provenance: https://api.github.com/repos/electron/electron/releases/216069933
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 30 are checked with a SAST tool
Score
6.5
/10
Last Scanned on 2025-05-08T19:17:41Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More